New issue
Advanced search Search tips

Issue 847347 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Jul 9
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: started in webthread_impl_for_worker_scheduler.cc

Project Member Reported by ClusterFuzz, May 29 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6424850642763776

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  started in webthread_impl_for_worker_scheduler.cc
  blink::scheduler::WebThreadImplForWorkerScheduler::WebThreadImplForWorkerSchedul
  content::BlinkPlatformImpl::CreateThread
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_v8_arm&range=523878:523927

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6424850642763776

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 29 2018

Components: Blink>WebAudio Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, May 29 2018

Labels: Test-Predator-Auto-Owner
Owner: hirosh...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/9b0a3407099993d8acaa29e01a90dcfa5c1de1c2 (Fix/add unit tests related to CachedMetadataHandler).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
The fuzzed test seems weird:

```
...
function generateReference(filterType, filterParameters) {
    var result = new Array(renderLengthSamples);
    for (var k = 0; k < result.length; ++k) {
        runTest();
    }
    for (var k = 0; k < nFilters; ++k) {
    }
}

...

function runTest() {
    var context = new OfflineAudioContext(2, sampleRate * renderLengthSeconds, sampleRate);
    var filterParameters = [{cutoff : 0, gain : 1 }, {cutoff : 1, gain : 1 }, {cutoff : 0.25, gain : 1 }, ];
    createTestAndRun(context, filterParameters);
}
runTest();
...

```

Here |renderLengthSample| is greater than 25000, so the test creates tons of threads in the loop. But also it fails on CHECK, not because of out-of-threads error.

I still think this is a mistake from the fuzzer side, but the crash should be handled more gracefully.
Project Member

Comment 4 by ClusterFuzz, Jun 1 2018

Labels: OS-Android
Components: -Internals>Core Blink>Workers
The CHECK() failure indicates that pthread_create() in CreateThread() in base/threading/platform_thread_posix.cc is failing (on Linux).
Project Member

Comment 6 by ClusterFuzz, Jul 9

ClusterFuzz has detected this issue as fixed in range 573223:573224.

Detailed report: https://clusterfuzz.com/testcase?key=6424850642763776

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  started in webthread_impl_for_worker_scheduler.cc
  blink::scheduler::WebThreadImplForWorkerScheduler::WebThreadImplForWorkerSchedul
  content::BlinkPlatformImpl::CreateThread
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_v8_arm&range=523878:523927
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_v8_arm&range=573223:573224

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6424850642763776

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Jul 9

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6424850642763776 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment