New issue
Advanced search Search tips

Issue 879946 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 721175
Owner:
Closed: Sep 4
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Stack-overflow in blink::PaintLayer::MarkCompositingContainerChainForNeedsRepaint

Project Member Reported by ClusterFuzz, Sep 3

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6196286198644736

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7ffe0fc7fff8
Crash State:
  blink::PaintLayer::MarkCompositingContainerChainForNeedsRepaint
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=571663:571669

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6196286198644736

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Sep 3

Components: Blink>Paint
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: pnangunoori@chromium.org
Labels: M-69 Test-Predator-Wrong
Owner: wangxianzhu@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using the code search for the file, “paint_layer.cc” assigning to owner concerned from GIT blame.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/af3e961ab018262a08de4b9c73e1ddeefce7160f

@wangxianzhu -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.
Thank You.

Comment 3 Deleted

Comment 4 Deleted

Blocking: -803649
Labels: -Pri-2 Pri-1
Comment 3 and 4 were for another bug, mistakenly added in this bug.
Status: WontFix (was: Assigned)
The test creates a dom tree with a depth of 3000 levels. Based on my debugging, the functions that are recursively called don't have infinite recursion, and the stack frame size is small. Even if the stack didn't overflow in paint_layer.cc, it would still overflow in other stages of the pipleline.

In addition, the stack overflow occurs in an asan build only. I tracked the stack frame size. In an asan build, the distances of stack pointers between each two function calls are much bigger than those in a normal build.
Mergedinto: -803649 721175
Status: Duplicate (was: WontFix)
Project Member

Comment 8 by ClusterFuzz, Jan 3

ClusterFuzz has detected this issue as fixed in range 619628:619629.

Detailed report: https://clusterfuzz.com/testcase?key=6196286198644736

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7ffe0fc7fff8
Crash State:
  blink::PaintLayer::MarkCompositingContainerChainForNeedsRepaint
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=571663:571669
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=619628:619629

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6196286198644736

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment