Issue metadata
Sign in to add a comment
|
Data race in v8::internal::libc_memmove |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5632263283539968 Fuzzer: inferno_twister Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race READ 8 Crash Address: 0x7b9000008000 Crash State: v8::internal::libc_memmove v8::internal::Execution::Call v8::Function::Call Sanitizer: thread (TSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=563792:563793 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5632263283539968 Additional requirements: Requires HTTP Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jun 2 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/b4a996805c069d26d5a63fcc79163a770310be12 (mac: Make extension_browsertests work in component builds.). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Jun 2 2018
Mac only cl, Linux bug.
,
Jun 13 2018
Adding some audio people because of blink::AudioBus being involved: WARNING: ThreadSanitizer: data race (pid=3143) Read of size 8 at 0x7b9000008000 by main thread (mutexes: write M862011893496158152): #0 0x557ffd66e93e in memmove third_party/llvm/compiler-rt/lib/tsan/../sanitizer_common/sanitizer_common_interceptors.inc:775:3 #1 0x557fffa3c0ba in v8::internal::libc_memmove(void*, void const*, unsigned long) v8/src/external-reference.cc:721:10 #0 0x5580001bd041 in chrome #3 0x557fffa33eb4 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) v8/src/execution.cc:191:10 #4 0x557fff557cda in v8::Function::Call(v8::Local<v8::Context>, v8::Local<v8::Value>, int, v8::Local<v8::Value>*) v8/src/api.cc:5217:7 #5 0x558004a15c5e in blink::V8ScriptRunner::CallFunction(v8::Local<v8::Function>, blink::ExecutionContext*, v8::Local<v8::Value>, int, v8::Local<v8::Value>*, v8::Isolate*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:386:17 #6 0x558004a37074 in blink::V8EventListener::CallListenerFunction(blink::ScriptState*, v8::Local<v8::Value>, blink::Event*) third_party/blink/renderer/bindings/core/v8/v8_event_listener.cc:115:8 #7 0x558004a37a33 in blink::V8AbstractEventListener::InvokeEventHandler(blink::ScriptState*, blink::Event*, v8::Local<v8::Value>) third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:171:20 #8 0x558004a377b0 in blink::V8AbstractEventListener::HandleEvent(blink::ScriptState*, blink::Event*) third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:120:3 #9 0x558004a37620 in blink::V8AbstractEventListener::handleEvent(blink::ExecutionContext*, blink::Event*) third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:108:3 #10 0x55800528a14c in blink::EventTarget::FireEventListeners(blink::Event*, blink::EventTargetData*, blink::HeapVector<blink::RegisteredEventListener, 1ul>&) third_party/blink/renderer/core/dom/events/event_target.cc:804:15 #11 0x55800528930a in blink::EventTarget::FireEventListeners(blink::Event*) third_party/blink/renderer/core/dom/events/event_target.cc:656:29 #12 0x55800528914f in blink::EventTarget::DispatchEventInternal(blink::Event*) third_party/blink/renderer/core/dom/events/event_target.cc:560:41 #13 0x5580052890c7 in blink::EventTarget::DispatchEvent(blink::Event*) third_party/blink/renderer/core/dom/events/event_target.cc:553:10 #14 0x558006ec9319 in blink::ScriptProcessorHandler::FireProcessEvent(unsigned int) third_party/blink/renderer/modules/webaudio/script_processor_node.cc:280:16 #15 0x558006ecc2f9 in base::internal::Invoker<base::internal::BindState<void (blink::ScriptProcessorHandler::*)(unsigned int), scoped_refptr<blink::ScriptProcessorHandler>, unsigned int>, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:507:12 #16 0x5580049d8749 in blink::(anonymous namespace)::RunCrossThreadClosure(WTF::CrossThreadFunction<void ()>) base/callback.h:136:12 #17 0x5580049d8daa in base::internal::Invoker<base::internal::BindState<void (*)(WTF::CrossThreadFunction<void ()>), WTF::CrossThreadFunction<void ()> >, void ()>::RunOnce(base::internal::BindStateBase*) base/bind_internal.h:407:12 #18 0x5580009a929b in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/callback.h:96:12 #19 0x558000296006 in base::sequence_manager::internal::ThreadControllerImpl::DoWork(base::sequence_manager::internal::ThreadControllerImpl::WorkType) third_party/blink/renderer/platform/scheduler/base/thread_controller_impl.cc:166:21 #20 0x558000297572 in base::internal::Invoker<base::internal::BindState<void (base::sequence_manager::internal::ThreadControllerImpl::*)(base::sequence_manager::internal::ThreadControllerImpl::WorkType), base::WeakPtr<base::sequence_manager::internal::ThreadControllerImpl>, base::sequence_manager::internal::ThreadControllerImpl::WorkType>, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:507:12 #21 0x5580009a929b in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/callback.h:96:12 #22 0x5580009d787c in base::internal::IncomingTaskQueue::RunTask(base::PendingTask*) base/message_loop/incoming_task_queue.cc:131:19 #23 0x5580009d5d9e in base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:319:25 #24 0x5580009d6461 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:329:5 #25 0x5580009da9e2 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:37:31 #26 0x5580009d57c1 in non-virtual thunk to base::MessageLoop::Run(bool) base/message_loop/message_loop.cc:271:12 #27 0x558000a0f82b in base::RunLoop::Run() base/run_loop.cc:102:14 #28 0x5580072e5f0b in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:218:23 #29 0x55800050382c in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:567:14 #30 0x558000504468 in content::RunOtherNamedProcessTypeMain(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:657:12 #31 0x5580005052d1 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:969:10 #32 0x5580005019c0 in content::ContentServiceManagerMainDelegate::RunEmbedderProcess() content/app/content_service_manager_main_delegate.cc:53:32 #33 0x558000512ab3 in service_manager::Main(service_manager::MainParams const&) services/service_manager/embedder/main.cc:459:29 #34 0x558000502cbf in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:10 #35 0x557ffd6cf445 in ChromeMain chrome/app/chrome_main.cc:101:12 #36 0x557ffd6cf39f in main chrome/app/chrome_exe_main_aura.cc:17:10 Previous write of size 8 at 0x7b9000008000 by thread T11 (mutexes: write M837242078365783664): #0 0x557ffd66e7ca in memset third_party/llvm/compiler-rt/lib/tsan/../sanitizer_common/sanitizer_common_interceptors.inc:764:3 #1 0x55800498c159 in blink::AudioBus::CopyFrom(blink::AudioBus const&, blink::AudioBus::ChannelInterpretation) third_party/blink/renderer/platform/audio/audio_channel.h #2 0x558006ec8b21 in blink::ScriptProcessorHandler::Process(unsigned long) third_party/blink/renderer/modules/webaudio/script_processor_node.cc:190:26 #3 0x558006e22ad6 in blink::AudioHandler::ProcessIfNecessary(unsigned long) third_party/blink/renderer/modules/webaudio/audio_node.cc:351:7 #4 0x558006e1fa5e in blink::AudioNodeOutput::Pull(blink::AudioBus*, unsigned long) third_party/blink/renderer/modules/webaudio/audio_node_output.cc:142:13 #5 0x558006e2c390 in blink::AudioNodeInput::Pull(blink::AudioBus*, unsigned long) third_party/blink/renderer/modules/webaudio/audio_node_input.cc:193:40 #6 0x558006e48639 in blink::AudioDestinationHandler::Render(blink::AudioBus*, blink::AudioBus*, unsigned long, blink::AudioIOPosition const&) third_party/blink/renderer/modules/webaudio/audio_destination_node.cc:92:37 #7 0x558006e4882e in non-virtual thunk to blink::AudioDestinationHandler::Render(blink::AudioBus*, blink::AudioBus*, unsigned long, blink::AudioIOPosition const&) third_party/blink/renderer/modules/webaudio/audio_destination_node.cc #8 0x558006e971c0 in blink::AudioDestination::RequestRender(unsigned long, unsigned long, double, double, unsigned long) third_party/blink/renderer/platform/audio/audio_destination.cc:186:15 #9 0x558006e96c48 in blink::AudioDestination::Render(blink::WebVector<float*> const&, unsigned long, double, double, unsigned long) third_party/blink/renderer/platform/audio/audio_destination.cc:145:5 #10 0x5580072e2a99 in content::RendererWebAudioDeviceImpl::Render(base::TimeDelta, base::TimeTicks, int, media::AudioBus*) content/renderer/media/renderer_webaudiodevice_impl.cc:219:21 #11 0x5580072e2b1e in non-virtual thunk to content::RendererWebAudioDeviceImpl::Render(base::TimeDelta, base::TimeTicks, int, media::AudioBus*) content/renderer/media/renderer_webaudiodevice_impl.cc #12 0x557ffdfb7942 in media::SilentSinkSuspender::Render(base::TimeDelta, base::TimeTicks, int, media::AudioBus*) media/base/silent_sink_suspender.cc:83:14 #13 0x557ffdf4eb15 in media::AudioOutputDeviceThreadCallback::Process(unsigned int) media/audio/audio_output_device_thread_callback.cc:116:21 #14 0x557ffdf35965 in media::AudioDeviceThread::ThreadMain() media/audio/audio_device_thread.cc:79:18 #15 0x558000aaabde in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:76:13 Location is heap block of size 8192 at 0x7b9000008000 allocated by main thread: #0 0x557ffd663b18 in malloc third_party/llvm/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:664:5 #1 0x558004858847 in WTF::ArrayBufferContents::ArrayBufferContents(unsigned int, unsigned int, WTF::ArrayBufferContents::SharingType, WTF::ArrayBufferContents::InitializationPolicy) base/allocator/partition_allocator/partition_alloc.h:318:18 #2 0x558005477f49 in WTF::ArrayBuffer::CreateOrNull(unsigned int, unsigned int, WTF::ArrayBufferContents::InitializationPolicy) third_party/blink/renderer/platform/wtf/typed_arrays/array_buffer.h:183:23 #3 0x558006e6700d in scoped_refptr<WTF::Float32Array> WTF::TypedArrayBase<float>::CreateOrNull<WTF::Float32Array>(unsigned int) third_party/blink/renderer/platform/wtf/typed_arrays/array_buffer.h:157:10 #4 0x558006e65a1a in blink::AudioBuffer::AudioBuffer(unsigned int, unsigned long, float, blink::AudioBuffer::InitializationPolicy) third_party/blink/renderer/platform/wtf/typed_arrays/float32_array.h:84:10 #5 0x558006e64de5 in blink::AudioBuffer::Create(unsigned int, unsigned long, float) third_party/blink/renderer/modules/webaudio/audio_buffer.cc:51:11 #6 0x558006ec807a in blink::ScriptProcessorHandler::Initialize() third_party/blink/renderer/modules/webaudio/script_processor_node.cc:107:15 #7 0x558006ec7f84 in blink::ScriptProcessorHandler::ScriptProcessorHandler(blink::AudioNode&, float, unsigned long, unsigned int, unsigned int) third_party/blink/renderer/modules/webaudio/script_processor_node.cc:77:3 #8 0x558006ec9d35 in blink::ScriptProcessorNode::ScriptProcessorNode(blink::BaseAudioContext&, float, unsigned long, unsigned int, unsigned int) third_party/blink/renderer/modules/webaudio/script_processor_node.cc:86:29 #9 0x558006eca698 in blink::ScriptProcessorNode::Create(blink::BaseAudioContext&, unsigned long, unsigned int, unsigned int, blink::ExceptionState&) third_party/blink/renderer/modules/webaudio/script_processor_node.cc:486:35 #10 0x558006eca7c4 in blink::ScriptProcessorNode::Create(blink::BaseAudioContext&, unsigned long, blink::ExceptionState&) third_party/blink/renderer/modules/webaudio/script_processor_node.cc:405:10 #11 0x558006e333ba in blink::BaseAudioContext::createScriptProcessor(unsigned long, blink::ExceptionState&) third_party/blink/renderer/modules/webaudio/base_audio_context.cc:423:10 #12 0x558006e45d45 in blink::V8BaseAudioContext::createScriptProcessorMethodCallback(v8::FunctionCallbackInfo<v8::Value> const&) gen/third_party/blink/renderer/bindings/modules/v8/v8_base_audio_context.cc:507:41 #13 0x557fff5f392f in v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo*) v8/src/api-arguments-inl.h:95:3 #14 0x557fff5f2880 in v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) v8/src/builtins/builtins-api.cc:110:36 #15 0x557fff5f1758 in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-api.cc:140:5 #16 0x557fff5f12df in v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) v8/src/builtins/builtins-api.cc:128:1 #1 0x5580001cf56e in chrome #18 0x557fffa33eb4 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*) v8/src/execution.cc:191:10 #19 0x557fff53bc40 in v8::Script::Run(v8::Local<v8::Context>) v8/src/api.cc:2187:7
,
Jun 13 2018
Well, the stack trace weirdly looked familiar to me so I did a little bit of search. By design, ScriptProcessorNode has data race. Also as noted in the linked issue, the feature is deprecated from the spec so now sure if it is worth to fix the issue. The potential fix would be generating a new AudioBuffer for every render quantum and it will affect many WebAudio projects out there.
,
Jun 14 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/tools/build/+/663ee79bafc48df9f84fae54ff4640b1655b9f0c commit 663ee79bafc48df9f84fae54ff4640b1655b9f0c Author: Andrii Shyshkalov <tandrii@chromium.org> Date: Thu Jun 14 00:41:17 2018 chromium.infra: mark testonly builders which don't upload CIPD packages. R=vadimsh Bug: 848985 Change-Id: I03398f388ee4fa49db26bb9df26815860f80a027 Reviewed-on: https://chromium-review.googlesource.com/1100302 Reviewed-by: Vadim Shtayura <vadimsh@chromium.org> Commit-Queue: Andrii Shyshkalov <tandrii@chromium.org> [modify] https://crrev.com/663ee79bafc48df9f84fae54ff4640b1655b9f0c/masters/master.chromium.infra/master.cfg
,
Jun 14 2018
Re #6: It doesn't seem to be correct. The CL is irrelevant to this bug.
,
Jun 14 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/tools/build/+/e8d5cb11c8a5acb02d6e316972a756074726c8c5 commit e8d5cb11c8a5acb02d6e316972a756074726c8c5 Author: Andrii Shyshkalov <tandrii@chromium.org> Date: Thu Jun 14 00:45:06 2018 chromium.infra: no longer upload CIPD packages for win64, linux32 and mac64. These will be uploaded in LUCI builders. R=vadimsh Bug: 848985 Change-Id: I73cc4979fc4340453ec2c2a0ac8f66dcf38faa50 Reviewed-on: https://chromium-review.googlesource.com/1100306 Reviewed-by: Vadim Shtayura <vadimsh@chromium.org> Commit-Queue: Andrii Shyshkalov <tandrii@chromium.org> [modify] https://crrev.com/e8d5cb11c8a5acb02d6e316972a756074726c8c5/masters/master.chromium.infra/master.cfg
,
Jun 14 2018
The following revision refers to this bug: https://chrome-internal.googlesource.com/infra/infra_internal/+/b145a0cf376c54fe528a03fd5240a473a2fcff3e commit b145a0cf376c54fe528a03fd5240a473a2fcff3e Author: Andrii Shyshkalov <tandrii@chromium.org> Date: Thu Jun 14 02:39:59 2018
,
Jun 14 2018
The following revision refers to this bug: https://chrome-internal.googlesource.com/chrome/tools/build/+/235fe011d1ce2648c830c4add78995efbdc4e57c commit 235fe011d1ce2648c830c4add78995efbdc4e57c Author: Andrii Shyshkalov <tandrii@chromium.org> Date: Thu Jun 14 19:44:59 2018
,
Jun 14 2018
The following revision refers to this bug: https://chrome-internal.googlesource.com/infra/infra_internal/+/328826fc8a99d9a32005e7599849fd7a50c0b19b commit 328826fc8a99d9a32005e7599849fd7a50c0b19b Author: Andrii Shyshkalov <tandrii@chromium.org> Date: Thu Jun 14 21:11:09 2018
,
Jun 14 2018
For the record, the CLs that are landing like in c#11 actually are for issue 848984. I typo the bug number all the time too. |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Jun 2 2018Labels: Test-Predator-Auto-Components