New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 879899 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Dec 6
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Chrome
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in base::sequence_manager::ThreadManager::GetTaskQueueFor

Project Member Reported by ClusterFuzz, Sep 2

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5274926492418048

Fuzzer: libFuzzer_sequence_manager_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  base::sequence_manager::ThreadManager::GetTaskQueueFor
  base::sequence_manager::ThreadManager::PostDelayedTask
  base::sequence_manager::ThreadManager::ExecuteThread
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=586733:586756

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5274926492418048

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Sep 2

Components: Blink>Scheduling
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Sep 2

Cc: farahcharab@google.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

SQM Fuzzer: Add support for cross-thread posting. by farahcharab@google.com - https://chromium.googlesource.com/chromium/src/+/f67097b4acac3a85de15f259ee38295da301802e

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Cc: skyos...@chromium.org altimin@chromium.org alexclarke@chromium.org
Cc: -farahcharab@google.com kkaluri@chromium.org
Labels: M-71
Owner: farahcharab@chromium.org
Status: Assigned (was: Untriaged)
As predator has provided 1 possible suspect

SQM Fuzzer: Add support for cross-thread posting. by farahcharab@google.com - https://chromium.googlesource.com/chromium/src/+/f67097b4acac3a85de15f259ee38295da301802e


Hence assigning it to farahcharab@
Owner: altimin@chromium.org
Project Member

Comment 6 by ClusterFuzz, Dec 1

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 5274926492418048 appears to be flaky, updating reproducibility label.
Labels: -Unreproducible Reproducible
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Labels: -Unreproducible Reproducible
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Project Member

Comment 9 by ClusterFuzz, Dec 6

Labels: OS-Chrome
Project Member

Comment 10 by ClusterFuzz, Dec 6

ClusterFuzz has detected this issue as fixed in range 614319:614322.

Detailed report: https://clusterfuzz.com/testcase?key=5274926492418048

Fuzzer: libFuzzer_sequence_manager_fuzzer
Fuzz target binary: sequence_manager_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  base::sequence_manager::ThreadManager::GetTaskQueueFor
  base::sequence_manager::ThreadManager::PostDelayedTask
  base::sequence_manager::ThreadManager::ExecuteThread
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=586733:586756
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=614319:614322

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5274926492418048

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Dec 6

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5274926492418048 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment