Issue metadata
Sign in to add a comment
|
Data race in base::MD5Final |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5909055269502976 Fuzzer: inferno_layout_test_unmodified Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race READ 1 Crash Address: 0x7f983dbbd6d2 Crash State: base::MD5Final base::MD5Sum base::HashMetricName Sanitizer: thread (TSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=561853:561855 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5909055269502976 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
May 25 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/f84fffabdef28f8577bf4b8c5f5ec73e73991927 (Improve support for audio-device group IDs on Linux.). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
May 25 2018
Data race stack: WARNING: ThreadSanitizer: data race (pid=25917) Read of size 1 at 0x7f983dbbd6d2 by thread T19 (mutexes: write M3161): #0 0x565296860ce0 in base::MD5Final(base::MD5Digest*, char (*) [88]) base/md5.cc:43:9 #1 0x56529686119b in base::MD5Sum(void const*, unsigned long, base::MD5Digest*) base/md5.cc:290:3 #2 0x565296883ce6 in base::HashMetricName(base::BasicStringPiece<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >) base/metrics/metrics_hashes.cc:27:3 #3 0x56529687a841 in base::Histogram::Factory::Build() base/metrics/histogram.cc:165:51 #4 0x56529687ae4b in base::Histogram::FactoryTimeGet(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::TimeDelta, base::TimeDelta, unsigned int, int) base/metrics/histogram.cc:258:63 #5 0x56529687b1f2 in base::Histogram::FactoryTimeGet(char const*, base::TimeDelta, base::TimeDelta, unsigned int, int) base/metrics/histogram.cc:294:10 I don't understand why there's a rate in md5 code? Does it change global state?
,
May 25 2018
Actually that might be a red herring. Later in the report is this which is likely the real issue: WARNING: ThreadSanitizer: unlock of an unlocked mutex (or by a wrong thread) (pid=25917) #0 0x56529363b779 in pthread_cond_wait third_party/llvm/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:1133:3 #1 0x7f983c9e0e48 in pa_threaded_mainloop_wait (/usr/lib/x86_64-linux-gnu/libpulse.so.0+0x32e47) #2 0x565293f092a8 in media::pulse::GetRealDefaultDeviceId(pa_threaded_mainloop*, pa_context*, media::pulse::RequestType) media/audio/pulse/pulse_util.cc:300:5 #3 0x565293f0598f in media::AudioManagerPulse::GetDefaultOutputDeviceID() media/audio/pulse/audio_manager_pulse.cc:168:10 #4 0x565293ee1ca6 in media::AudioManagerBase::GetDefaultOutputStreamParameters() media/audio/audio_manager_base.cc:482:45 #5 0x565293ef57fb in media::AudioSystemHelper::ComputeOutputParameters(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) media/audio/audio_system_helper.cc:136:29 #6 0x565293ef5700 in media::AudioSystemHelper::GetOutputStreamParameters(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::OnceCallback<void (base::Optional<media::AudioParameters> const&)>) media/audio/audio_system_helper.cc:52:31 #7 0x565294f20bde in audio::SystemInfo::GetOutputStreamParameters(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, base::OnceCallback<void (base::Optional<media::AudioParameters> const&)>) services/audio/system_info.cc:42:11 #8 0x565294f2cfd3 in audio::mojom::SystemInfoStubDispatch::AcceptWithResponder(audio::mojom::SystemInfo*, mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiverWithStatus, std::__1::default_delete<mojo::MessageReceiverWithStatus> >) gen/services/audio/public/mojom/system_info.mojom.cc:1565:13 #9 0x565294f21e12 in audio::mojom::SystemInfoStub<mojo::RawPtrImplRefTraits<audio::mojom::SystemInfo> >::AcceptWithResponder(mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiverWithStatus, std::__1::default_delete<mojo::MessageReceiverWithStatus> >) gen/services/audio/public/mojom/system_info.mojom.h:221:12
,
May 28 2018
Based on #4, marking as duplicate of bug 847098
,
May 29 2018
ClusterFuzz has detected this issue as fixed in range 562265:562266. Detailed report: https://clusterfuzz.com/testcase?key=5909055269502976 Fuzzer: inferno_layout_test_unmodified Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race READ 1 Crash Address: 0x7f983dbbd6d2 Crash State: base::MD5Final base::MD5Sum base::HashMetricName Sanitizer: thread (TSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=561853:561855 Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=562265:562266 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5909055269502976 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by ClusterFuzz
, May 25 2018Labels: Test-Predator-Auto-Components