New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 863603 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Jul 14
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug

Blocked on:
issue angleproject:2713



Sign in to add a comment

angle_end2end_tests, angle_white_box_tests and angle_perftests failing on Linux TSAN bot

Project Member Reported by kbr@chromium.org, Jul 13

Issue description

Sorry for not noticing this a couple of days ago when it started.

The angle_end2end_tests, angle_white_box_tests and angle_perftests test suites are failing on the Linux TSAN bot. The first failing build was:

https://ci.chromium.org/p/chromium/builders/luci.chromium.ci/Linux%20FYI%20GPU%20TSAN%20Release/14741

and they're still failing on top of tree:

https://ci.chromium.org/p/chromium/builders/luci.chromium.ci/Linux%20FYI%20GPU%20TSAN%20Release/14837

Here's one stack trace from one of the earlier builds:

WARNING: ThreadSanitizer: heap-use-after-free (pid=20027)
  Read of size 2 at 0x7b08000437f0 by main thread:
    #0 createSurfaceVk third_party/angle/src/libANGLE/renderer/vulkan/xcb/WindowSurfaceVkXcb.cpp:42 (libGLESv2.so+0x605765)
    #1 initializeImpl third_party/angle/src/libANGLE/renderer/vulkan/SurfaceVk.cpp:325 (libGLESv2.so+0x5de9a8)
    #2 initialize third_party/angle/src/libANGLE/renderer/vulkan/SurfaceVk.cpp:319 (libGLESv2.so+0x5de8fc)
    #3 initialize third_party/angle/src/libANGLE/Surface.cpp:158 (libGLESv2.so+0x341949)
    #4 createWindowSurface third_party/angle/src/libANGLE/Display.cpp:623 (libGLESv2.so+0x2a81eb)
    #5 CreateWindowSurface third_party/angle/src/libGLESv2/entry_points_egl.cpp:282 (libGLESv2.so+0x1d52ff)
    #6 eglCreateWindowSurface third_party/angle/src/libEGL/libEGL.cpp:58 (libEGL.so+0x42e0)
    #7 initializeDisplayAndSurface third_party/angle/util/EGLWindow.cpp:300 (libangle_util.so+0x131a5)
    #8 ANGLETestSetUp third_party/angle/src/tests/test_utils/ANGLETest.cpp:299 (angle_end2end_tests+0xbe3fe1)
    #9 ANGLETest::SetUp() third_party/angle/src/tests/test_utils/ANGLETest.cpp:984 (angle_end2end_tests+0xbe5ff9)
    #10 SetUp third_party/angle/src/tests/gl_tests/AttributeLayoutTest.cpp:248 (angle_end2end_tests+0x54d342)
    #11 non-virtual thunk to (anonymous namespace)::AttributeLayoutTest::SetUp() third_party/angle/src/tests/gl_tests/AttributeLayoutTest.cpp:? (angle_end2end_tests+0x54db10)
    #12 Run third_party/googletest/src/googletest/src/gtest.cc:? (angle_end2end_tests+0xd42e9b)
    #13 Run third_party/googletest/src/googletest/src/gtest.cc:2667 (angle_end2end_tests+0xd43f3c)
    #14 Run third_party/googletest/src/googletest/src/gtest.cc:2785 (angle_end2end_tests+0xd447c6)
    #15 RunAllTests third_party/googletest/src/googletest/src/gtest.cc:5047 (angle_end2end_tests+0xd54e36)
    #16 Run third_party/googletest/src/googletest/src/gtest.cc:? (angle_end2end_tests+0xd5471a)
    #17 RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2329 (angle_end2end_tests+0xe0be35)
    #18 Run base/test/test_suite.cc:277 (angle_end2end_tests+0xe0be35)
    #19 (anonymous namespace)::RunHelper(base::TestSuite*) gpu/angle_end2end_tests_main.cc:19 (angle_end2end_tests+0xbef722)
    #20 Invoke<int (*const &)(base::TestSuite *), base::TestSuite *> base/bind_internal.h:407 (angle_end2end_tests+0xbef774)
    #21 MakeItSo<int (*const &)(base::TestSuite *), base::TestSuite *> base/bind_internal.h:607 (angle_end2end_tests+0xbef774)
    #22 RunImpl<int (*const &)(base::TestSuite *), const std::__1::tuple<base::internal::UnretainedWrapper<base::TestSuite> > &, 0> base/bind_internal.h:680 (angle_end2end_tests+0xbef774)
    #23 Run base/bind_internal.h:662 (angle_end2end_tests+0xbef774)
    #24 Run base/callback.h:99 (angle_end2end_tests+0xe0f7d8)
    #25 LaunchUnitTestsInternal base/test/launcher/unit_test_launcher.cc:225 (angle_end2end_tests+0xe0f7d8)
    #26 LaunchUnitTestsWithOptions base/test/launcher/unit_test_launcher.cc:597 (angle_end2end_tests+0xe0feff)
    #27 main gpu/angle_end2end_tests_main.cc:29 (angle_end2end_tests+0xbef6a0)

  Previous write of size 8 at 0x7b08000437f0 by main thread:
    #0 free /b/swarming/w/ir/kitchen-workdir/src/third_party/llvm/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:707 (angle_end2end_tests+0x4d5674)
    #1 createSurfaceVk third_party/angle/src/libANGLE/renderer/vulkan/xcb/WindowSurfaceVkXcb.cpp:40 (libGLESv2.so+0x60575c)
    #2 initializeImpl third_party/angle/src/libANGLE/renderer/vulkan/SurfaceVk.cpp:325 (libGLESv2.so+0x5de9a8)
    #3 initialize third_party/angle/src/libANGLE/renderer/vulkan/SurfaceVk.cpp:319 (libGLESv2.so+0x5de8fc)
    #4 initialize third_party/angle/src/libANGLE/Surface.cpp:158 (libGLESv2.so+0x341949)
    #5 createWindowSurface third_party/angle/src/libANGLE/Display.cpp:623 (libGLESv2.so+0x2a81eb)
    #6 CreateWindowSurface third_party/angle/src/libGLESv2/entry_points_egl.cpp:282 (libGLESv2.so+0x1d52ff)
    #7 eglCreateWindowSurface third_party/angle/src/libEGL/libEGL.cpp:58 (libEGL.so+0x42e0)
    #8 initializeDisplayAndSurface third_party/angle/util/EGLWindow.cpp:300 (libangle_util.so+0x131a5)
    #9 ANGLETestSetUp third_party/angle/src/tests/test_utils/ANGLETest.cpp:299 (angle_end2end_tests+0xbe3fe1)
    #10 ANGLETest::SetUp() third_party/angle/src/tests/test_utils/ANGLETest.cpp:984 (angle_end2end_tests+0xbe5ff9)
    #11 SetUp third_party/angle/src/tests/gl_tests/AttributeLayoutTest.cpp:248 (angle_end2end_tests+0x54d342)
    #12 non-virtual thunk to (anonymous namespace)::AttributeLayoutTest::SetUp() third_party/angle/src/tests/gl_tests/AttributeLayoutTest.cpp:? (angle_end2end_tests+0x54db10)
    #13 Run third_party/googletest/src/googletest/src/gtest.cc:? (angle_end2end_tests+0xd42e9b)
    #14 Run third_party/googletest/src/googletest/src/gtest.cc:2667 (angle_end2end_tests+0xd43f3c)
    #15 Run third_party/googletest/src/googletest/src/gtest.cc:2785 (angle_end2end_tests+0xd447c6)
    #16 RunAllTests third_party/googletest/src/googletest/src/gtest.cc:5047 (angle_end2end_tests+0xd54e36)
    #17 Run third_party/googletest/src/googletest/src/gtest.cc:? (angle_end2end_tests+0xd5471a)
    #18 RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2329 (angle_end2end_tests+0xe0be35)
    #19 Run base/test/test_suite.cc:277 (angle_end2end_tests+0xe0be35)
    #20 (anonymous namespace)::RunHelper(base::TestSuite*) gpu/angle_end2end_tests_main.cc:19 (angle_end2end_tests+0xbef722)
    #21 Invoke<int (*const &)(base::TestSuite *), base::TestSuite *> base/bind_internal.h:407 (angle_end2end_tests+0xbef774)
    #22 MakeItSo<int (*const &)(base::TestSuite *), base::TestSuite *> base/bind_internal.h:607 (angle_end2end_tests+0xbef774)
    #23 RunImpl<int (*const &)(base::TestSuite *), const std::__1::tuple<base::internal::UnretainedWrapper<base::TestSuite> > &, 0> base/bind_internal.h:680 (angle_end2end_tests+0xbef774)
    #24 Run base/bind_internal.h:662 (angle_end2end_tests+0xbef774)
    #25 Run base/callback.h:99 (angle_end2end_tests+0xe0f7d8)
    #26 LaunchUnitTestsInternal base/test/launcher/unit_test_launcher.cc:225 (angle_end2end_tests+0xe0f7d8)
    #27 LaunchUnitTestsWithOptions base/test/launcher/unit_test_launcher.cc:597 (angle_end2end_tests+0xe0feff)
    #28 main gpu/angle_end2end_tests_main.cc:29 (angle_end2end_tests+0xbef6a0)

SUMMARY: ThreadSanitizer: heap-use-after-free third_party/angle/src/libANGLE/renderer/vulkan/xcb/WindowSurfaceVkXcb.cpp:42 in createSurfaceVk


It looks like it's caught a legitimate bug. Jamie, could you triage and/or assign this bug? Thanks.

 
Cc: theoking@google.com
Thanks for filing Ken. I wonder if this is a similar issue to one Omar found on Linux. We found there were uninitialized variables being read.
Yes that's definitely caused by the issue we were describing, we are freeing the "reply" variable before we use the contents in it - see WindowSurfaceVkXcb.cpp line 42
Blockedon: angleproject:2713
Project Member

Comment 4 by bugdroid1@chromium.org, Jul 14

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/92e955f2c4ab38fcabeb32acb03ff019247a912a

commit 92e955f2c4ab38fcabeb32acb03ff019247a912a
Author: Omar El Sheikh <theoking@google.com>
Date: Sat Jul 14 03:15:34 2018

Vulkan: Fix premature pointer freeing

Pointer was freed before using it's contents to set the
value of the ImageExtent to be returned

Bug:  863603 
Change-Id: Ibdb26c862f3216e7314516f7aee64942467b4add
Reviewed-on: https://chromium-review.googlesource.com/1137349
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Commit-Queue: Jamie Madill <jmadill@chromium.org>

[modify] https://crrev.com/92e955f2c4ab38fcabeb32acb03ff019247a912a/src/libANGLE/renderer/vulkan/xcb/WindowSurfaceVkXcb.cpp

Owner: jmad...@chromium.org
Status: Fixed (was: Untriaged)
Thanks Omar for fixing this. Bots seem to have recovered.

Sign in to add a comment