New issue
Advanced search Search tips

Issue 903729 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Dec 2
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in base::sequence_manager::internal::TaskQueueImpl::NotifyDidProcessTask

Project Member Reported by ClusterFuzz, Nov 9

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5702756410851328

Fuzzer: ifratric-browserfuzzer-v3
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  base::sequence_manager::internal::TaskQueueImpl::NotifyDidProcessTask
  base::sequence_manager::internal::SequenceManagerImpl::NotifyDidProcessTask
  base::sequence_manager::internal::SequenceManagerImpl::DidRunTask
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5702756410851328

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
 
Project Member

Comment 1 by ClusterFuzz, Nov 9

Components: Internals>TaskScheduler
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: kkaluri@chromium.org
Labels: Test-Predator-Wrong
Owner: altimin@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.

Using Code Search for the file, "sequence_manager_impl.cc" suspecting the below Cl might have caused this issue

Suspect CL: https://chromium.googlesource.com/chromium/src/+/599348982c3306fa9528c58a2a473126e46494db

altimin@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!
Project Member

Comment 3 by ClusterFuzz, Dec 2

ClusterFuzz has detected this issue as fixed in range 609121:609122.

Detailed report: https://clusterfuzz.com/testcase?key=5702756410851328

Fuzzer: ifratric-browserfuzzer-v3
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  base::sequence_manager::internal::TaskQueueImpl::NotifyDidProcessTask
  base::sequence_manager::internal::SequenceManagerImpl::NotifyDidProcessTask
  base::sequence_manager::internal::SequenceManagerImpl::DidRunTask
  
Sanitizer: address (ASAN)

Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=609121:609122

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5702756410851328

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Dec 2

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5702756410851328 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment