New issue
Advanced search Search tips

Issue 855117 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Abrt in blink::PaintLayerCompositor::UpdateIfNeeded

Project Member Reported by ClusterFuzz, Jun 21 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4961955136405504

Fuzzer: dstockwell-anim-gen
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x053900000001
Crash State:
  blink::PaintLayerCompositor::UpdateIfNeeded
  blink::PaintLayerCompositor::UpdateIfNeededRecursiveInternal
  blink::PaintLayerCompositor::UpdateIfNeededRecursiveInternal
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=568181:568188

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4961955136405504

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jun 21 2018

Components: Blink>Compositing
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jun 21 2018

Cc: chrishtr@chromium.org jbroman@chromium.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

[PE] Skip compositing requirements recursion when possible by chrishtr@chromium.org - https://chromium.googlesource.com/chromium/src/+/441691865aadd99164e8d23953ba15072e269587

Replace FrameHostMsg_GetPlugins with a Mojo interface. by jbroman@chromium.org - https://chromium.googlesource.com/chromium/src/+/b702474f0f48698e0b5a1ed0f0e79e13684148ca

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Owner: chrishtr@chromium.org
Status: Assigned (was: Untriaged)
The recursion skipping patch seems likely to be to blame. Assigning based on that.
The bug is that when an element changes its stacking order position, we
don't invalidate and force recursion.
Project Member

Comment 5 by bugdroid1@chromium.org, Jun 25 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/93f946c0a26a54ee1d257b3e0de4ec8b154d5aba

commit 93f946c0a26a54ee1d257b3e0de4ec8b154d5aba
Author: Chris Harrelson <chrishtr@chromium.org>
Date: Mon Jun 25 04:34:37 2018

[Fast compositing] Force compositing requirements update on change of stacking order.

Bug:  855117 

Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_slimming_paint_v2;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I730e489bf6880252ce5474551e4c624d9baa18d7
Reviewed-on: https://chromium-review.googlesource.com/1112704
Reviewed-by: Tien-Ren Chen <trchen@chromium.org>
Commit-Queue: Chris Harrelson <chrishtr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#569964}
[add] https://crrev.com/93f946c0a26a54ee1d257b3e0de4ec8b154d5aba/third_party/WebKit/LayoutTests/compositing/iframes/stacking-context-change-composited-iframe-content-crash-expected.txt
[add] https://crrev.com/93f946c0a26a54ee1d257b3e0de4ec8b154d5aba/third_party/WebKit/LayoutTests/compositing/iframes/stacking-context-change-composited-iframe-content-crash.html
[modify] https://crrev.com/93f946c0a26a54ee1d257b3e0de4ec8b154d5aba/third_party/blink/renderer/core/paint/compositing/compositing_requirements_updater.cc
[modify] https://crrev.com/93f946c0a26a54ee1d257b3e0de4ec8b154d5aba/third_party/blink/renderer/core/paint/paint_layer.cc
[modify] https://crrev.com/93f946c0a26a54ee1d257b3e0de4ec8b154d5aba/third_party/blink/renderer/core/paint/paint_layer.h
[modify] https://crrev.com/93f946c0a26a54ee1d257b3e0de4ec8b154d5aba/third_party/blink/renderer/core/paint/paint_layer_stacking_node.cc

Status: Fixed (was: Assigned)
Project Member

Comment 7 by ClusterFuzz, Jun 25 2018

ClusterFuzz has detected this issue as fixed in range 569963:569964.

Detailed report: https://clusterfuzz.com/testcase?key=4961955136405504

Fuzzer: dstockwell-anim-gen
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x053900000001
Crash State:
  blink::PaintLayerCompositor::UpdateIfNeeded
  blink::PaintLayerCompositor::UpdateIfNeededRecursiveInternal
  blink::PaintLayerCompositor::UpdateIfNeededRecursiveInternal
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=568181:568188
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=569963:569964

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4961955136405504

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Jun 25 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 4961955136405504 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment