Issue metadata
Sign in to add a comment
|
ASan reports use-after-free on Windows in ExtensionInstalledBubbleBrowserTest.InvokeUi_* tests |
||||||||||||||||||||||||
Issue descriptionVarious ExtensionsInstalledBubbleBrowserTest tests fail: ExtensionInstalledBubbleBrowserTest.InvokeUi_PageAction ExtensionInstalledBubbleBrowserTest.InvokeUi_Omnibox ExtensionInstalledBubbleBrowserTest.InvokeUi_SignInPromo ExtensionInstalledBubbleBrowserTest.InvokeUi_BrowserAction ExtensionInstalledBubbleBrowserTest.InvokeUi_NoAction ExtensionInstalledBubbleBrowserTest.InvokeUi_InstalledByDefault Example build: https://ci.chromium.org/buildbot/chromium.clang/CrWinAsan/800 I think this is a real memory bug. ASan gives a relatively understandable UAF report: ==7200==ERROR: AddressSanitizer: heap-use-after-free on address 0x11cdb6d58b68 at pc 0x7ff685100ea2 bp 0x0032198f8260 sp 0x0032198f8268 #0 0x7ff685100ea1 in ExtensionInstalledBubbleView::GetWindowTitle C:\b\c\b\CrWinAsan\src\chrome\browser\ui\views\extensions\extension_installed_bubble_view.cc:219 #1 0x7ff678038bb5 in SkFontMgr::legacyMakeTypeface C:\b\c\b\CrWinAsan\src\third_party\skia\src\core\SkFontMgr.cpp:164 #2 0x7ff6833b3661 in views::internal::RootView::GetAccessibleNodeData C:\b\c\b\CrWinAsan\src\ui\views\widget\root_view.cc:601 #3 0x7ff67f565e54 in views::ViewAccessibility::GetAccessibleNodeData C:\b\c\b\CrWinAsan\src\ui\views\accessibility\view_accessibility.cc:62 #4 0x7ff682c25c61 in `anonymous namespace'::DoesViewHaveAccessibilityErrorsRecursive C:\b\c\b\CrWinAsan\src\chrome\test\views\accessibility_checker.cc:101 #5 0x7ff682c25873 in AddFailureOnWidgetAccessibilityError C:\b\c\b\CrWinAsan\src\chrome\test\views\accessibility_checker.cc:118 #6 0x7ff67f6291e3 in views::Widget::OnNativeWidgetVisibilityChanged C:\b\c\b\CrWinAsan\src\ui\views\widget\widget.cc:1063 #7 0x7ff68732e4ff in views::HWNDMessageHandler::OnWindowPosChanged C:\b\c\b\CrWinAsan\src\ui\views\win\hwnd_message_handler.cc:2665 #8 0x7ff68731a39e in views::HWNDMessageHandler::_ProcessWindowMessage C:\b\c\b\CrWinAsan\src\ui\views\win\hwnd_message_handler.h:414 #9 0x7ff687315bc9 in views::HWNDMessageHandler::OnWndProc C:\b\c\b\CrWinAsan\src\ui\views\win\hwnd_message_handler.cc:935 #10 0x7ff683804d16 in base::win::WrappedWindowProc<&gfx::WindowImpl::WndProc> C:\b\c\b\CrWinAsan\src\base\win\wrapped_window_proc.h:76 #11 0x7ffb373dbc4f in CallWindowProcW+0x4cf (C:\Windows\System32\USER32.dll+0x18000bc4f) #12 0x7ffb373db94b in CallWindowProcW+0x1cb (C:\Windows\System32\USER32.dll+0x18000b94b) #13 0x7ffb373f3e7f in IsThreadMessageQueueAttached+0x3f (C:\Windows\System32\USER32.dll+0x180023e7f) #14 0x7ffb393790a3 in KiUserCallbackDispatcher+0x23 (C:\Windows\SYSTEM32\ntdll.dll+0x1800a90a3) #15 0x7ffb367c23c3 in NtUserDestroyWindow+0x13 (C:\Windows\System32\win32u.dll+0x1800023c3) #16 0x7ff67f6256bf in views::Widget::CloseNow C:\b\c\b\CrWinAsan\src\ui\views\widget\widget.cc:602 #17 0x7ff67eb3ac41 in base::debug::TaskAnnotator::RunTask C:\b\c\b\CrWinAsan\src\base\debug\task_annotator.cc:101 #18 0x7ff67ebb0f9d in base::MessageLoop::RunTask C:\b\c\b\CrWinAsan\src\base\message_loop\message_loop.cc:319 #19 0x7ff67ebb2387 in base::MessageLoop::DoWork C:\b\c\b\CrWinAsan\src\base\message_loop\message_loop.cc:373 #20 0x7ff67ebb6c10 in base::MessagePumpForUI::DoRunLoop C:\b\c\b\CrWinAsan\src\base\message_loop\message_pump_win.cc:173 #21 0x7ff67ebb57b8 in base::MessagePumpWin::Run C:\b\c\b\CrWinAsan\src\base\message_loop\message_pump_win.cc:56 #22 0x7ff67ec39344 in base::RunLoop::Run C:\b\c\b\CrWinAsan\src\base\run_loop.cc:102 #23 0x7ff6767274db in TestBrowserDialog::DismissUi C:\b\c\b\CrWinAsan\src\chrome\browser\ui\test\test_browser_dialog.cc:123 #24 0x7ff6767294ab in TestBrowserUi::ShowAndVerifyUi C:\b\c\b\CrWinAsan\src\chrome\browser\ui\test\test_browser_ui.cc:40 #25 0x7ff67eead514 in content::BrowserTestBase::ProxyRunTestOnMainThreadLoop C:\b\c\b\CrWinAsan\src\content\public\test\browser_test_base.cc:409 #26 0x7ff682c34516 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl C:\b\c\b\CrWinAsan\src\chrome\browser\chrome_browser_main.cc:1996 #27 0x7ff682c30ea5 in ChromeBrowserMainParts::PreMainMessageLoopRun C:\b\c\b\CrWinAsan\src\chrome\browser\chrome_browser_main.cc:1380 #28 0x7ff67a399abc in content::BrowserMainLoop::PreMainMessageLoopRun C:\b\c\b\CrWinAsan\src\content\browser\browser_main_loop.cc:961 #29 0x7ff67b1ceda1 in content::StartupTaskRunner::RunAllTasksNow C:\b\c\b\CrWinAsan\src\content\browser\startup_task_runner.cc:43 #30 0x7ff67a394e5f in content::BrowserMainLoop::CreateStartupTasks C:\b\c\b\CrWinAsan\src\content\browser\browser_main_loop.cc:872 #31 0x7ff67a3a1740 in content::BrowserMainRunnerImpl::Initialize C:\b\c\b\CrWinAsan\src\content\browser\browser_main_runner_impl.cc:148 #32 0x7ff67a38e2c6 in content::BrowserMain C:\b\c\b\CrWinAsan\src\content\browser\browser_main.cc:47 #33 0x7ff67e9e0ca0 in content::RunBrowserProcessMain C:\b\c\b\CrWinAsan\src\content\app\content_main_runner_impl.cc:621 #34 0x7ff67e9e2d1e in content::ContentMainRunnerImpl::Run C:\b\c\b\CrWinAsan\src\content\app\content_main_runner_impl.cc:983 #35 0x7ff68046f7ea in service_manager::Main C:\b\c\b\CrWinAsan\src\services\service_manager\embedder\main.cc:459 #36 0x7ff67e9e0996 in content::ContentMain C:\b\c\b\CrWinAsan\src\content\app\content_main.cc:19 #37 0x7ff67eeac6c3 in content::BrowserTestBase::SetUp C:\b\c\b\CrWinAsan\src\content\public\test\browser_test_base.cc:325 #38 0x7ff67ed9ee86 in InProcessBrowserTest::SetUp C:\b\c\b\CrWinAsan\src\chrome\test\base\in_process_browser_test.cc:248 #39 0x7ff677ec6996 in testing::Test::Run C:\b\c\b\CrWinAsan\src\third_party\googletest\src\googletest\src\gtest.cc:2487 #40 0x7ff677ec8582 in testing::TestInfo::Run C:\b\c\b\CrWinAsan\src\third_party\googletest\src\googletest\src\gtest.cc:2667 #41 0x7ff677ec9621 in testing::TestCase::Run C:\b\c\b\CrWinAsan\src\third_party\googletest\src\googletest\src\gtest.cc:2785 #42 0x7ff677ee159d in testing::internal::UnitTestImpl::RunAllTests C:\b\c\b\CrWinAsan\src\third_party\googletest\src\googletest\src\gtest.cc:5047 #43 0x7ff677ee0ae5 in testing::UnitTest::Run C:\b\c\b\CrWinAsan\src\third_party\googletest\src\googletest\src\gtest.cc:4663 #44 0x7ff67eddcc29 in base::TestSuite::Run C:\b\c\b\CrWinAsan\src\base\test\test_suite.cc:275 #45 0x7ff68e3c3c97 in ChromeTestSuiteRunner::RunTestSuite C:\b\c\b\CrWinAsan\src\chrome\test\base\chrome_test_launcher.cc:65 #46 0x7ff67ef0de7e in content::LaunchTests C:\b\c\b\CrWinAsan\src\content\public\test\test_launcher.cc:625 #47 0x7ff68e3c4a41 in LaunchChromeTests C:\b\c\b\CrWinAsan\src\chrome\test\base\chrome_test_launcher.cc:170 #48 0x7ff68e3c3ab9 in main C:\b\c\b\CrWinAsan\src\chrome\test\base\browser_tests_main.cc:36 #49 0x7ff68e4269bb in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:283 #50 0x7ffb37532773 in BaseThreadInitThunk+0x13 (C:\Windows\System32\KERNEL32.DLL+0x180012773) #51 0x7ffb39340d50 in RtlUserThreadStart+0x20 (C:\Windows\SYSTEM32\ntdll.dll+0x180070d50) 0x11cdb6d58b68 is located 8 bytes inside of 104-byte region [0x11cdb6d58b60,0x11cdb6d58bc8) freed by thread T0 here: #0 0x7ff68e3ea421 in free c:\b\c\b\crwinasan\src\third_party\llvm\projects\compiler-rt\lib\asan\asan_malloc_win.cc:44 #1 0x7ff6816e3515 in ExtensionInstalledBubble::~ExtensionInstalledBubble C:\b\c\b\CrWinAsan\src\chrome\browser\ui\extensions\extension_installed_bubble.cc:201 #2 0x7ff6812e1126 in BubbleController::~BubbleController C:\b\c\b\CrWinAsan\src\components\bubble\bubble_controller.cc:23 #3 0x7ff6812e1c49 in BubbleController::~BubbleController C:\b\c\b\CrWinAsan\src\components\bubble\bubble_controller.cc:20 #4 0x7ff6753d0e94 in std::vector<std::unique_ptr<MockSpellCheckHost,std::default_delete<MockSpellCheckHost> >,std::allocator<std::unique_ptr<MockSpellCheckHost,std::default_delete<MockSpellCheckHost> > > >::_Tidy C:\b\c\win_toolchain\vs_files\3bc0ec615cf20ee342f3bc29bc991b5ad66d8d2c\VC\Tools\MSVC\14.14.26428\include\vector:2014 #5 0x7ff6812e2a2c in BubbleManager::CloseAllMatchingBubbles C:\b\c\b\CrWinAsan\src\components\bubble\bubble_manager.cc:133 #6 0x7ff6812e24ed in BubbleManager::CloseBubble C:\b\c\b\CrWinAsan\src\components\bubble\bubble_manager.cc:51 #7 0x7ff6812e1304 in BubbleController::CloseBubble C:\b\c\b\CrWinAsan\src\components\bubble\bubble_controller.cc:27 #8 0x7ff685102515 in ExtensionInstalledBubbleUi::OnWidgetClosing C:\b\c\b\CrWinAsan\src\chrome\browser\ui\views\extensions\extension_installed_bubble_view.cc:391 #9 0x7ff67f625617 in views::Widget::CloseNow C:\b\c\b\CrWinAsan\src\ui\views\widget\widget.cc:601 #10 0x7ff67eb3ac41 in base::debug::TaskAnnotator::RunTask C:\b\c\b\CrWinAsan\src\base\debug\task_annotator.cc:101 #11 0x7ff67ebb0f9d in base::MessageLoop::RunTask C:\b\c\b\CrWinAsan\src\base\message_loop\message_loop.cc:319 #12 0x7ff67ebb2387 in base::MessageLoop::DoWork C:\b\c\b\CrWinAsan\src\base\message_loop\message_loop.cc:373 #13 0x7ff67ebb6c10 in base::MessagePumpForUI::DoRunLoop C:\b\c\b\CrWinAsan\src\base\message_loop\message_pump_win.cc:173 #14 0x7ff67ebb57b8 in base::MessagePumpWin::Run C:\b\c\b\CrWinAsan\src\base\message_loop\message_pump_win.cc:56 #15 0x7ff67ec39344 in base::RunLoop::Run C:\b\c\b\CrWinAsan\src\base\run_loop.cc:102 #16 0x7ff6767274db in TestBrowserDialog::DismissUi C:\b\c\b\CrWinAsan\src\chrome\browser\ui\test\test_browser_dialog.cc:123 #17 0x7ff6767294ab in TestBrowserUi::ShowAndVerifyUi C:\b\c\b\CrWinAsan\src\chrome\browser\ui\test\test_browser_ui.cc:40 #18 0x7ff67eead514 in content::BrowserTestBase::ProxyRunTestOnMainThreadLoop C:\b\c\b\CrWinAsan\src\content\public\test\browser_test_base.cc:409 #19 0x7ff682c34516 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl C:\b\c\b\CrWinAsan\src\chrome\browser\chrome_browser_main.cc:1996 #20 0x7ff682c30ea5 in ChromeBrowserMainParts::PreMainMessageLoopRun C:\b\c\b\CrWinAsan\src\chrome\browser\chrome_browser_main.cc:1380 #21 0x7ff67a399abc in content::BrowserMainLoop::PreMainMessageLoopRun C:\b\c\b\CrWinAsan\src\content\browser\browser_main_loop.cc:961 #22 0x7ff67b1ceda1 in content::StartupTaskRunner::RunAllTasksNow C:\b\c\b\CrWinAsan\src\content\browser\startup_task_runner.cc:43 #23 0x7ff67a394e5f in content::BrowserMainLoop::CreateStartupTasks C:\b\c\b\CrWinAsan\src\content\browser\browser_main_loop.cc:872 #24 0x7ff67a3a1740 in content::BrowserMainRunnerImpl::Initialize C:\b\c\b\CrWinAsan\src\content\browser\browser_main_runner_impl.cc:148 #25 0x7ff67a38e2c6 in content::BrowserMain C:\b\c\b\CrWinAsan\src\content\browser\browser_main.cc:47 #26 0x7ff67e9e0ca0 in content::RunBrowserProcessMain C:\b\c\b\CrWinAsan\src\content\app\content_main_runner_impl.cc:621 #27 0x7ff67e9e2d1e in content::ContentMainRunnerImpl::Run C:\b\c\b\CrWinAsan\src\content\app\content_main_runner_impl.cc:983 #28 0x7ff68046f7ea in service_manager::Main C:\b\c\b\CrWinAsan\src\services\service_manager\embedder\main.cc:459 #29 0x7ff67e9e0996 in content::ContentMain C:\b\c\b\CrWinAsan\src\content\app\content_main.cc:19 previously allocated by thread T0 here: #0 0x7ff68e3ea541 in malloc c:\b\c\b\crwinasan\src\third_party\llvm\projects\compiler-rt\lib\asan\asan_malloc_win.cc:60 #1 0x7ff68e403292 in operator new f:\dd\vctools\crt\vcstartup\src\heap\new_scalar.cpp:35 #2 0x7ff67655e61a in ExtensionInstalledBubbleBrowserTest::MakeBubble C:\b\c\b\CrWinAsan\src\chrome\browser\ui\extensions\extension_installed_bubble_browsertest.cc:83 #3 0x7ff67655ebb6 in ExtensionInstalledBubbleBrowserTest::ShowUi C:\b\c\b\CrWinAsan\src\chrome\browser\ui\extensions\extension_installed_bubble_browsertest.cc:109 #4 0x7ff67672924e in TestBrowserUi::ShowAndVerifyUi C:\b\c\b\CrWinAsan\src\chrome\browser\ui\test\test_browser_ui.cc:34 #5 0x7ff67eead514 in content::BrowserTestBase::ProxyRunTestOnMainThreadLoop C:\b\c\b\CrWinAsan\src\content\public\test\browser_test_base.cc:409 #6 0x7ff682c34516 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl C:\b\c\b\CrWinAsan\src\chrome\browser\chrome_browser_main.cc:1996 #7 0x7ff682c30ea5 in ChromeBrowserMainParts::PreMainMessageLoopRun C:\b\c\b\CrWinAsan\src\chrome\browser\chrome_browser_main.cc:1380 #8 0x7ff67a399abc in content::BrowserMainLoop::PreMainMessageLoopRun C:\b\c\b\CrWinAsan\src\content\browser\browser_main_loop.cc:961 #9 0x7ff67b1ceda1 in content::StartupTaskRunner::RunAllTasksNow C:\b\c\b\CrWinAsan\src\content\browser\startup_task_runner.cc:43 #10 0x7ff67a394e5f in content::BrowserMainLoop::CreateStartupTasks C:\b\c\b\CrWinAsan\src\content\browser\browser_main_loop.cc:872 #11 0x7ff67a3a1740 in content::BrowserMainRunnerImpl::Initialize C:\b\c\b\CrWinAsan\src\content\browser\browser_main_runner_impl.cc:148 #12 0x7ff67a38e2c6 in content::BrowserMain C:\b\c\b\CrWinAsan\src\content\browser\browser_main.cc:47 #13 0x7ff67e9e0ca0 in content::RunBrowserProcessMain C:\b\c\b\CrWinAsan\src\content\app\content_main_runner_impl.cc:621 #14 0x7ff67e9e2d1e in content::ContentMainRunnerImpl::Run C:\b\c\b\CrWinAsan\src\content\app\content_main_runner_impl.cc:983 #15 0x7ff68046f7ea in service_manager::Main C:\b\c\b\CrWinAsan\src\services\service_manager\embedder\main.cc:459 #16 0x7ff67e9e0996 in content::ContentMain C:\b\c\b\CrWinAsan\src\content\app\content_main.cc:19 #17 0x7ff67eeac6c3 in content::BrowserTestBase::SetUp C:\b\c\b\CrWinAsan\src\content\public\test\browser_test_base.cc:325 #18 0x7ff67ed9ee86 in InProcessBrowserTest::SetUp C:\b\c\b\CrWinAsan\src\chrome\test\base\in_process_browser_test.cc:248 #19 0x7ff677ec6996 in testing::Test::Run C:\b\c\b\CrWinAsan\src\third_party\googletest\src\googletest\src\gtest.cc:2487 #20 0x7ff677ec8582 in testing::TestInfo::Run C:\b\c\b\CrWinAsan\src\third_party\googletest\src\googletest\src\gtest.cc:2667 #21 0x7ff677ec9621 in testing::TestCase::Run C:\b\c\b\CrWinAsan\src\third_party\googletest\src\googletest\src\gtest.cc:2785 #22 0x7ff677ee159d in testing::internal::UnitTestImpl::RunAllTests C:\b\c\b\CrWinAsan\src\third_party\googletest\src\googletest\src\gtest.cc:5047 #23 0x7ff677ee0ae5 in testing::UnitTest::Run C:\b\c\b\CrWinAsan\src\third_party\googletest\src\googletest\src\gtest.cc:4663 #24 0x7ff67eddcc29 in base::TestSuite::Run C:\b\c\b\CrWinAsan\src\base\test\test_suite.cc:275 #25 0x7ff68e3c3c97 in ChromeTestSuiteRunner::RunTestSuite C:\b\c\b\CrWinAsan\src\chrome\test\base\chrome_test_launcher.cc:65 #26 0x7ff67ef0de7e in content::LaunchTests C:\b\c\b\CrWinAsan\src\content\public\test\test_launcher.cc:625 #27 0x7ff68e3c4a41 in LaunchChromeTests C:\b\c\b\CrWinAsan\src\chrome\test\base\chrome_test_launcher.cc:170 #28 0x7ff68e3c3ab9 in main C:\b\c\b\CrWinAsan\src\chrome\test\base\browser_tests_main.cc:36 #29 0x7ff68e4269bb in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:283 SUMMARY: AddressSanitizer: heap-use-after-free C:\b\c\b\CrWinAsan\src\chrome\browser\ui\views\extensions\extension_installed_bubble_view.cc:219 in ExtensionInstalledBubbleView::GetWindowTitle Please take a look. We should disable these tests. These tests always fail with Windows ASan, but without ASan, they will be flaky.
,
Jun 20 2018
-> Extensions for triage. These are coming from src\chrome\test\views\accessibility_checker.cc I expect this is a Real bug in release builds for a11y users. If accessibility_checker.cc can access the Widget in this state, then so can Windows a11y tools. See Issue 624560 and other crashes on GetWindowTitle for bugs that have happened in the wild around this.
,
Jun 22 2018
jam@, I wonder if this is the same issue you're targeting in https://chromium-review.googlesource.com/c/chromium/src/+/1093023?
,
Jun 22 2018
,
Jul 23
|
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by bugdroid1@chromium.org
, Jun 20 2018