New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 852391 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Timeout in third_party_re2_fuzzer

Project Member Reported by ClusterFuzz, Jun 13 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5142404647354368

Fuzzer: libFuzzer_third_party_re2_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  third_party_re2_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=562498:562507

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5142404647354368

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jun 13 2018

Cc: mmoroz@chromium.org thakis@chromium.org tfarina@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Components: Tools>Stability>libFuzzer
Labels: -Pri-1 M-69 Test-Predator-Wrong Pri-2
Owner: junyer@chromium.org
Status: Assigned (was: Untriaged)
This issue looks similar to  bug 829420 , hence assigning to the same owner for more updates.

junyer@ Could you please take a look in to this issue?

Thanks!

Comment 3 by junyer@google.com, Jun 14 2018

F(\PP\PL){995} is the minimised testcase, but that shouldn't be possible as per https://github.com/google/re2/blob/master/re2/parse.cc#L46-L51. Is the FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION macro not being defined anymore?

Comment 5 by junyer@google.com, Jun 14 2018

https://github.com/google/re2/blob/master/re2/re2.cc#L381-L387 is another place where the FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION macro is used, so I imagine that another timeout will be reported in the near future.

Comment 6 by junyer@google.com, Jun 14 2018

P.S. Surely RE2 cannot be the only project experiencing this problem? Many projects are using the macro because (I presume) http://libfuzzer.info#fuzzer-friendly-build-mode told them to use it. I expect that fuzzing without defining the macro that means "we are fuzzing you" will be troublesome.

Comment 7 by mmoroz@chromium.org, Jun 14 2018

Cc: junyer@chromium.org
Owner: mmoroz@chromium.org
Status: Started (was: Assigned)
Good catch! For some reason, we don't use optimize_for_fuzzing with debug build:
https://build.chromium.org/deprecated/chromium.fyi/builders/Libfuzzer%20Upload%20Linux%20ASan%20Debug/builds/12971

https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.fyi%2FLibfuzzer_Upload_Linux_ASan_Debug%2F12971%2F%2B%2Frecipes%2Fsteps%2Fgenerate_build_files%2F0%2Fstdout


We do use it for all the others, I've just verified.

junyer@, thanks for the investigation! I'll fix this.

Project Member

Comment 8 by bugdroid1@chromium.org, Jun 14 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8b309f7cd5c104c38428dbe4b0202f44859a104a

commit 8b309f7cd5c104c38428dbe4b0202f44859a104a
Author: Max Moroz <mmoroz@chromium.org>
Date: Thu Jun 14 17:09:11 2018

Enable optimize_for_fuzzing GN flag for libFuzzer ASan Debug configuration.

The flag is being used for all other configurations for a while. Looks like
we've forgotten to add it for the Debug one when it's been implemented.

Bug:  852391 
Change-Id: I2f3fbd4639fdb81b304f0abdd0c8fe6f3d1dbcb3
Reviewed-on: https://chromium-review.googlesource.com/1100964
Reviewed-by: Jonathan Metzman <metzman@chromium.org>
Reviewed-by: John Budorick <jbudorick@chromium.org>
Commit-Queue: Max Moroz <mmoroz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#567318}
[modify] https://crrev.com/8b309f7cd5c104c38428dbe4b0202f44859a104a/tools/mb/mb_config.pyl

Project Member

Comment 9 by ClusterFuzz, Jun 15 2018

ClusterFuzz has detected this issue as fixed in range 567310:567338.

Detailed report: https://clusterfuzz.com/testcase?key=5142404647354368

Fuzzer: libFuzzer_third_party_re2_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  third_party_re2_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=562498:562507
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=567310:567338

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5142404647354368

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Jun 16 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 5142404647354368 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment