New issue
Advanced search Search tips

Issue 892025 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Oct 9
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug

Blocked on:
issue 890468



Sign in to add a comment

CHECK failure: MOJO_RESULT_OK == result in data_pipe.h

Project Member Reported by ClusterFuzz, Oct 4

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6606631633420288

Fuzzer: inferno_twister
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  MOJO_RESULT_OK == result in data_pipe.h
  mojo::DataPipe::DataPipe
  blink::FileReaderLoader::Start
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6606631633420288

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 4

Components: Blink>Storage>FileAPI Internals>Mojo
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Owner: wanderview@chromium.org
Status: Assigned (was: Untriaged)
Ben, can you take a look at this? I'm pretty sure this is caused by your changes (and specifically the changes in https://chromium.googlesource.com/chromium/src/+/25b9a8e66efcad49b254d4c0a1b09cb9a9c8a6b8%5E%21/#F9 where you change from CreateDataPipe to using the mojo::DataPipe class instead. Using mojo::DataPipe as opposed to CreateDataPipe means that any failure to create the pipe is a CHECK rather than just something the calling code can handle.
(and to be honest I'm not sure why mojo::DataPipe (still) exists. This was a problem we ran into way back, and I assumed it got fixed by now, hence why I didn't comment on this in the code review...)
Ugh.  There is code all over that uses mojo::DataPipe() and then checks that the resulting handles are valid to test for error.  I assumed that was the right way to do this.

Should I change these all back to the verbose CreateDataPipe()?  Or maybe we can make all DataPipe() call sites check that the handles are valid after so that we can keep this more concise syntax.  What do you think?
I don't know. Either seems fine to me. I'm not entirely sure what the original rational is for making DataPipe CHECK fail if it failed to create a pipe, but it's definitely confusing API...
It doesn't seem like CreateDataPipe is that much more verbose (well, I guess it is if you want to specify just the size of the buffer), so even getting rid of DataPipe correctly to avoid this foot-gun seems sensible to me, but mojo folks might have different opinions.
The verbosity comes from having to declare separate mojo::ScopedDataPipeConsumerHandle and ProduceHandle variables.  Its at least 3 lines of code vs 1 with the constructor short-hand.  Not a big deal I guess, but annoying.
Blockedon: 890468
Project Member

Comment 9 by ClusterFuzz, Oct 9

ClusterFuzz has detected this issue as fixed in range 597685:597687.

Detailed report: https://clusterfuzz.com/testcase?key=6606631633420288

Fuzzer: inferno_twister
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  MOJO_RESULT_OK == result in data_pipe.h
  mojo::DataPipe::DataPipe
  blink::FileReaderLoader::Start
  
Sanitizer: address (ASAN)

Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=597685:597687

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6606631633420288

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Oct 9

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6606631633420288 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Status: Started (was: Verified)
The clusterfuzz crashes probably became less likely when the mojo::DataPipe constructor was changed not to double-allocate.  We still risk hitting the CHECK, though.

I'm going to land the CL that switches the code back to CreateDataPipe() since the constructor is still using a CHECK.
Status: Fixed (was: Started)

Sign in to add a comment