New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 846783 link

Starred by 2 users

Issue metadata

Status: Duplicate
Merged: issue 847098
Owner:
Closed: May 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Data race in base::MD5Final

Project Member Reported by ClusterFuzz, May 25 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5909055269502976

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 1
Crash Address: 0x7f983dbbd6d2
Crash State:
  base::MD5Final
  base::MD5Sum
  base::HashMetricName
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=561853:561855

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5909055269502976

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 25 2018

Components: Internals>Core Internals>Metrics
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, May 25 2018

Labels: Test-Predator-Auto-Owner
Owner: guidou@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/f84fffabdef28f8577bf4b8c5f5ec73e73991927 (Improve support for audio-device group IDs on Linux.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Data race stack:

WARNING: ThreadSanitizer: data race (pid=25917)
Read of size 1 at 0x7f983dbbd6d2 by thread T19 (mutexes: write M3161):
 #0 0x565296860ce0 in base::MD5Final(base::MD5Digest*, char (*) [88]) base/md5.cc:43:9
 #1 0x56529686119b in base::MD5Sum(void const*, unsigned long, base::MD5Digest*) base/md5.cc:290:3
 #2 0x565296883ce6 in base::HashMetricName(base::BasicStringPiece<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >) base/metrics/metrics_hashes.cc:27:3
#3 0x56529687a841 in base::Histogram::Factory::Build() base/metrics/histogram.cc:165:51
#4 0x56529687ae4b in base::Histogram::FactoryTimeGet(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::TimeDelta, base::TimeDelta, unsigned int, int) base/metrics/histogram.cc:258:63
#5 0x56529687b1f2 in base::Histogram::FactoryTimeGet(char const*, base::TimeDelta, base::TimeDelta, unsigned int, int) base/metrics/histogram.cc:294:10


I don't understand why there's a rate in md5 code? Does it change global state?
Actually that might be a red herring. Later in the report is this which is likely the real issue:

WARNING: ThreadSanitizer: unlock of an unlocked mutex (or by a wrong thread) (pid=25917)
#0 0x56529363b779 in pthread_cond_wait third_party/llvm/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:1133:3
#1 0x7f983c9e0e48 in pa_threaded_mainloop_wait (/usr/lib/x86_64-linux-gnu/libpulse.so.0+0x32e47)
#2 0x565293f092a8 in media::pulse::GetRealDefaultDeviceId(pa_threaded_mainloop*, pa_context*, media::pulse::RequestType) media/audio/pulse/pulse_util.cc:300:5
#3 0x565293f0598f in media::AudioManagerPulse::GetDefaultOutputDeviceID() media/audio/pulse/audio_manager_pulse.cc:168:10
#4 0x565293ee1ca6 in media::AudioManagerBase::GetDefaultOutputStreamParameters() media/audio/audio_manager_base.cc:482:45
#5 0x565293ef57fb in media::AudioSystemHelper::ComputeOutputParameters(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) media/audio/audio_system_helper.cc:136:29
#6 0x565293ef5700 in media::AudioSystemHelper::GetOutputStreamParameters(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::OnceCallback<void (base::Optional<media::AudioParameters> const&)>) media/audio/audio_system_helper.cc:52:31
#7 0x565294f20bde in audio::SystemInfo::GetOutputStreamParameters(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::OnceCallback<void (base::Optional<media::AudioParameters> const&)>) services/audio/system_info.cc:42:11
#8 0x565294f2cfd3 in audio::mojom::SystemInfoStubDispatch::AcceptWithResponder(audio::mojom::SystemInfo*, mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiverWithStatus, std::__1::default_delete<mojo::MessageReceiverWithStatus> >) gen/services/audio/public/mojom/system_info.mojom.cc:1565:13
#9 0x565294f21e12 in audio::mojom::SystemInfoStub<mojo::RawPtrImplRefTraits<audio::mojom::SystemInfo> >::AcceptWithResponder(mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiverWithStatus, std::__1::default_delete<mojo::MessageReceiverWithStatus> >) gen/services/audio/public/mojom/system_info.mojom.h:221:12

Comment 5 by guidou@chromium.org, May 28 2018

Mergedinto: 847098
Status: Duplicate (was: Assigned)
Based on #4, marking as duplicate of  bug 847098 
Project Member

Comment 6 by ClusterFuzz, May 29 2018

ClusterFuzz has detected this issue as fixed in range 562265:562266.

Detailed report: https://clusterfuzz.com/testcase?key=5909055269502976

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 1
Crash Address: 0x7f983dbbd6d2
Crash State:
  base::MD5Final
  base::MD5Sum
  base::HashMetricName
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=561853:561855
Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=562265:562266

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5909055269502976

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment