CHECK failure: MOJO_RESULT_OK == result in data_pipe.h |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6606631633420288 Fuzzer: inferno_twister Job Type: linux_asan_chrome_mp Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: MOJO_RESULT_OK == result in data_pipe.h mojo::DataPipe::DataPipe blink::FileReaderLoader::Start Sanitizer: address (ASAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6606631633420288 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Oct 4
Ben, can you take a look at this? I'm pretty sure this is caused by your changes (and specifically the changes in https://chromium.googlesource.com/chromium/src/+/25b9a8e66efcad49b254d4c0a1b09cb9a9c8a6b8%5E%21/#F9 where you change from CreateDataPipe to using the mojo::DataPipe class instead. Using mojo::DataPipe as opposed to CreateDataPipe means that any failure to create the pipe is a CHECK rather than just something the calling code can handle.
,
Oct 4
(and to be honest I'm not sure why mojo::DataPipe (still) exists. This was a problem we ran into way back, and I assumed it got fixed by now, hence why I didn't comment on this in the code review...)
,
Oct 4
Ugh. There is code all over that uses mojo::DataPipe() and then checks that the resulting handles are valid to test for error. I assumed that was the right way to do this. Should I change these all back to the verbose CreateDataPipe()? Or maybe we can make all DataPipe() call sites check that the handles are valid after so that we can keep this more concise syntax. What do you think?
,
Oct 4
I don't know. Either seems fine to me. I'm not entirely sure what the original rational is for making DataPipe CHECK fail if it failed to create a pipe, but it's definitely confusing API... It doesn't seem like CreateDataPipe is that much more verbose (well, I guess it is if you want to specify just the size of the buffer), so even getting rid of DataPipe correctly to avoid this foot-gun seems sensible to me, but mojo folks might have different opinions.
,
Oct 4
The verbosity comes from having to declare separate mojo::ScopedDataPipeConsumerHandle and ProduceHandle variables. Its at least 3 lines of code vs 1 with the constructor short-hand. Not a big deal I guess, but annoying.
,
Oct 6
,
Oct 6
This is actually a regression from: https://chromium-review.googlesource.com/c/chromium/src/+/1258686
,
Oct 9
ClusterFuzz has detected this issue as fixed in range 597685:597687. Detailed report: https://clusterfuzz.com/testcase?key=6606631633420288 Fuzzer: inferno_twister Job Type: linux_asan_chrome_mp Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: MOJO_RESULT_OK == result in data_pipe.h mojo::DataPipe::DataPipe blink::FileReaderLoader::Start Sanitizer: address (ASAN) Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=597685:597687 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6606631633420288 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Oct 9
ClusterFuzz testcase 6606631633420288 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Oct 9
The clusterfuzz crashes probably became less likely when the mojo::DataPipe constructor was changed not to double-allocate. We still risk hitting the CHECK, though. I'm going to land the CL that switches the code back to CreateDataPipe() since the constructor is still using a CHECK.
,
Oct 9
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/ee7a089d44fb21e008ce04df2b5f83a1aa9ee26b commit ee7a089d44fb21e008ce04df2b5f83a1aa9ee26b Author: Ben Kelly <wanderview@chromium.org> Date: Tue Oct 09 16:23:38 2018 Use the fallible mojo::CreateDataPipe instead of the constructor form. R=kinuko@chromium.org, mek@chromium.org Bug: 892025 Change-Id: I34a8d819e7357ea38746c1105c0bddbfd1002a0a Reviewed-on: https://chromium-review.googlesource.com/c/1265875 Commit-Queue: Ben Kelly <wanderview@chromium.org> Reviewed-by: Marijn Kruisselbrink <mek@chromium.org> Reviewed-by: Kinuko Yasuda <kinuko@chromium.org> Cr-Commit-Position: refs/heads/master@{#597940} [modify] https://crrev.com/ee7a089d44fb21e008ce04df2b5f83a1aa9ee26b/content/browser/cache_storage/cache_storage_blob_to_disk_cache.cc [modify] https://crrev.com/ee7a089d44fb21e008ce04df2b5f83a1aa9ee26b/content/browser/service_worker/service_worker_installed_script_reader.cc [modify] https://crrev.com/ee7a089d44fb21e008ce04df2b5f83a1aa9ee26b/content/common/service_worker/service_worker_loader_helpers.cc [modify] https://crrev.com/ee7a089d44fb21e008ce04df2b5f83a1aa9ee26b/third_party/blink/renderer/core/fetch/form_data_bytes_consumer.cc [modify] https://crrev.com/ee7a089d44fb21e008ce04df2b5f83a1aa9ee26b/third_party/blink/renderer/core/fileapi/file_reader_loader.cc
,
Oct 9
|
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, Oct 4Labels: Test-Predator-Auto-Components