CHECK failure: !performing_user_action_ in textfield.cc |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5162746258391040 Fuzzer: ifratric_pdf_generic Job Type: linux_debug_chrome Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: !performing_user_action_ in textfield.cc views::Textfield::OnBeforeUserAction views::Textfield::OnBeforePointerAction Sanitizer: address (ASAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5162746258391040 Additional requirements: Requires Gestures Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jul 23
,
Jul 23
Tommy, I'm not actively working on Textfield, can you investigate or find another owner? Looks like a nested call to OnBeforeUserAction, or a failure to call OnAfterUserAction somewhere. Nothing appears amiss from a quick look, and my attempts to run clusterfuzz locally didn't repro. If needed, it might make sense to add some logging at callsites, or record the holder of the lock.
,
Jul 23
msw: Sounds good. I'm guessing I'm as good of an owner for this bug as anyone else then. I will get to this when I have a chance. :)
,
Jul 25
Oh boy this is not good. The root cause is that middle-click triggers a selection-paste on Linux. The way we implement that, we fire up a RunLoop within ui::SelectionRequestor::BlockTillSelectionNotifyForRequest to make an asynchronous operation blocking. Then, during this RunLoop, we (unintentionally) process the next user gesture, leading to nested user actions, leading to this crash. The sequence of gestures looks like: Running: xdotool windowactivate --sync 125829121 . Running: xdotool mouseup -- 1 . Running: xdotool mousemove --sync -- 730 60 . Running: xdotool click --repeat 3 -- 2 A root cause fix would be to make selection-paste not fire up an inner run loop.
,
Jul 29
ClusterFuzz testcase 5162746258391040 appears to be flaky, updating reproducibility label.
,
Aug 2
ClusterFuzz testcase 5162746258391040 is flaky and no longer crashes, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by kkaluri@chromium.org
, Jul 19Components: UI>Browser>Omnibox
Labels: M-68 Test-Predator-Wrong CF-NeedsTriage