New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 907598 link

Starred by 2 users
Status: Assigned
Owner:
kaznacheev@chromium.org
Cc:
jkardatzke@chromium.org
kaznacheev@chromium.org
█ jhawkins@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug



Sign in to add a comment

Memory corruption on login (debug mode)

Project Member Reported by iby@chromium.org, Nov 21 
Chrome Version: Debug build from ToT from Nov 20, 2018
Can't get to chrome://version
Login screen says Google Chrome 72.0.3617.0 (Platform 11281.0.2018_11_20_1350 (Test Build - iby) developer-build eve) SN:8321G02EF3

OS: ChromeOS

What steps will reproduce the problem?
(1) Build in debug mode (eve) 
(2) Deploy to temp partition
(3) Attach gdb
(4) Login

I had Crostini (Linux) activated, if that matters. 


What is the expected result?

No memory corruption


What happens instead?
gdb dies in tcmalloc::Abort()

(gdb) bt
#0  tcmalloc::Abort() ()
    at ../../third_party/tcmalloc/gperftools-2.0/chromium/src/base/abort.cc:15
#1  0x00005a9d4fbf48de in LogPrintf(int, char const*, __va_list_tag*) ()
    at ../../third_party/tcmalloc/gperftools-2.0/chromium/src/base/logging.h:241
#2  0x00005a9d4fbf4758 in RAW_VLOG(int, char const*, ...) ()
    at ../../third_party/tcmalloc/gperftools-2.0/chromium/src/base/logging.h:262
warning: (Internal error: pc 0x5a9d4fc2146e in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d4fc2146e in read in CU, but not in symtab.)
#3  0x00005a9d4fc2146f in MallocBlock::CheckForCorruptedBuffer(MallocBlockQueueEntry const&, unsigned long, unsigned char const*, unsigned long) ()
    at ../../third_party/tcmalloc/gperftools-2.0/chromium/src/debugallocation.cc:707
warning: (Internal error: pc 0x5a9d4fc211a7 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d4fc211a7 in read in CU, but not in symtab.)
#4  0x00005a9d4fc211a8 in MallocBlock::CheckForDanglingWrites(MallocBlockQueueEntry const&) ()
    at ../../third_party/tcmalloc/gperftools-2.0/chromium/src/debugallocation.cc:643
warning: (Internal error: pc 0x5a9d4fc1de39 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d4fc1de39 in read in CU, but not in symtab.)
#5  0x00005a9d4fc1de3a in MallocBlock::ProcessFreeQueue(MallocBlock*, unsigned long, int) ()
    at ../../third_party/tcmalloc/gperftools-2.0/chromium/src/debugallocation.cc:612
warning: (Internal error: pc 0x5a9d4fc232a3 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d4fc232a3 in read in CU, but not in symtab.)
#6  0x00005a9d4fc232a4 in MallocBlock::Deallocate(int) ()
    at ../../third_party/tcmalloc/gperftools-2.0/chromium/src/debugallocation.cc:561
warning: (Internal error: pc 0x5a9d4fc1a571 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d4fc1a571 in read in CU, but not in symtab.)
#7  0x00005a9d4fc1a572 in DebugDeallocate(void*, int) ()
    at ../../third_party/tcmalloc/gperftools-2.0/chromium/src/debugallocation.cc:1003
warning: (Internal error: pc 0x5a9d6b842252 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d6b842252 in read in CU, but not in symtab.)
#8  0x00005a9d6b842253 in tc_free ()
    at ../../third_party/tcmalloc/gperftools-2.0/chromium/src/debugallocation.cc:1173
#9  0x00005a9d5b2ee82d in (anonymous namespace)::TCFree(base::allocator::AllocatorDispatch const*, void*, void*) ()
    at ../../base/allocator/allocator_shim_default_dispatch_to_tcmalloc.cc:44
warning: (Internal error: pc 0x5a9d5b2ee372 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d5b2ee372 in read in CU, but not in symtab.)
#10 0x00005a9d5b2ee373 in ShimCppDelete ()
    at ../../base/allocator/allocator_shim.cc:170
warning: (Internal error: pc 0x5a9d5b2edd74 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d5b2edd74 in read in CU, but not in symtab.)
#11 0x00005a9d5b2edd75 in operator delete(void*) ()
    at ../../base/allocator/allocator_shim_override_cpp_symbols.h:23
warning: (Internal error: pc 0x5a9d5b492ddf in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d5b492ddf in read in CU, but not in symtab.)
#12 0x00005a9d5b492de0 in void base::RefCountedThreadSafe<mojo::ScopedInterfaceEndpointHandle::State, base::DefaultRefCountedThreadSafeTraits<mojo::ScopedInterfaceEndpointHandle::State> >::DeleteInternal<mojo::ScopedInterfaceEndpointHandle::State>(mojo::ScopedInterfaceEndpointHandle::State const*) ()
    at ../../base/memory/ref_counted.h:414
warning: (Internal error: pc 0x5a9d5b492da4 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d5b492da4 in read in CU, but not in symtab.)
#13 0x00005a9d5b492da5 in base::DefaultRefCountedThreadSafeTraits<mojo::ScopedInterfaceEndpointHandle::State>::Destruct(mojo::ScopedInterfaceEndpointHandle::State const*) () at ../../base/memory/ref_counted.h:369
warning: (Internal error: pc 0x5a9d5b492d87 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d5b492d87 in read in CU, but not in symtab.)
#14 0x00005a9d5b492d88 in base::RefCountedThreadSafe<mojo::ScopedInterfaceEndpointHandle::State, base::DefaultRefCountedThreadSafeTraits<mojo::ScopedInterfaceEndpointHandle::State> >::Release() const ()
    at ../../base/memory/ref_counted.h:403
warning: (Internal error: pc 0x5a9d5b492d44 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d5b492d44 in read in CU, but not in symtab.)
#15 0x00005a9d5b492d45 in scoped_refptr<mojo::ScopedInterfaceEndpointHandle::State>::Release(mojo::ScopedInterfaceEndpointHandle::State*) ()
    at ../../base/memory/scoped_refptr.h:284
warning: (Internal error: pc 0x5a9d5b491209 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d5b491209 in read in CU, but not in symtab.)
#16 0x00005a9d5b49120a in scoped_refptr<mojo::ScopedInterfaceEndpointHandle::State>::~scoped_refptr() () at ../../base/memory/scoped_refptr.h:208
warning: (Internal error: pc 0x5a9d5b4909d8 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d5b4909d8 in read in CU, but not in symtab.)
#17 0x00005a9d5b4909d9 in mojo::ScopedInterfaceEndpointHandle::~ScopedInterfaceEndpointHandle() ()
    at ../../mojo/public/cpp/bindings/lib/scoped_interface_endpoint_handle.cc:309
warning: (Internal error: pc 0x5a9d5074d644 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d5074d644 in read in CU, but not in symtab.)
#18 0x00005a9d5074d645 in mojo::AssociatedInterfaceRequest<autofill::mojom::PasswordGenerationAgent>::~AssociatedInterfaceRequest() ()
    at ../../mojo/public/cpp/bindings/associated_interface_ptr_info.h:34
warning: (Internal error: pc 0x5a9d5f2d77b2 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d5f2d77b2 in read in CU, but not in symtab.)
#19 0x00005a9d5f2d77b3 in cc::mojo_embedder::AsyncLayerTreeFrameSink::UnboundMessagePipes::~UnboundMessagePipes() ()
    at ../../cc/mojo_embedder/async_layer_tree_frame_sink.cc:66
warning: (Internal error: pc 0x5a9d5f2d824c in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d5f2d824c in read in CU, but not in symtab.)
---Type <return> to continue, or q <return> to quit---
#20 0x00005a9d5f2d824d in cc::mojo_embedder::AsyncLayerTreeFrameSink::~AsyncLayerTreeFrameSink() ()
    at ../../cc/mojo_embedder/async_layer_tree_frame_sink.cc:103
warning: (Internal error: pc 0x5a9d5f2d8668 in read in CU, but not in symtab.)
warning: (Internal error: pc 0x5a9d5f2d8668 in read in CU, but not in symtab.)
#21 0x00005a9d5f2d8669 in cc::mojo_embedder::AsyncLayerTreeFrameSink::~AsyncLayerTreeFrameSink() ()
    at ../../cc/mojo_embedder/async_layer_tree_frame_sink.cc:103

(Rest of call stack attached)
stack_trace_login_memcorruption
14.8 KB View Download

Comment 1 by iby@chromium.org, Nov 21 

Might be same underlying issue as https://bugs.chromium.org/p/chromium/issues/detail?id=907590

Comment 2 by iby@chromium.org, Nov 21 

I currently have Linux (Crostini) active with Emacs and Eclipse installed.

The Eclipse icon is wrong after the login finishes (just a penguin icon; it usually is the proper eclipse icon).

FWIW, Terminal and GNU Emacs are by themselves in the launcher, but Eclipse is by itself in a folder named "Linux apps". All on the second page.

Comment 3 by iby@chromium.org, Nov 21 

Correction: I also have GIMP installed. It's also showing up (on the first page of the launcher, which it didn't used to do) and also has the penguin icon instead of the correct icon.

Comment 4 by iby@chromium.org, Nov 21 

Another correction: I actually DON'T have Eclipse or GIMP installed inside Crostini, only Emacs. When I reboot using the Release version of Chrome, the icons don't appear.

So: the Eclipse and GIMP icons were in the Debug launcher but they weren't actually installed.

Comment 5 by iby@chromium.org, Nov 21 

Rebooted and tried again. Got a similar but not identical stack trace.
stack_trace_login_memcorruption2
22.5 KB View Download

Comment 6 by iby@chromium.org, Nov 26

Cc: jhawkins@chromium.org jkardatzke@chromium.org

Comment 7 by jhawkins@chromium.org, Nov 26 

iby: Does the crash repro if Crostini is disabled?  E.g. a clean slate machine.

Comment 8 by iby@chromium.org, Nov 27 

Yes, this happens even with a fresh install where Crostini has never been turned on.

It's in a slightly different location, but still a CheckForCorruptedBuffer failure.
stack_trace_login_memcorruption3
18.7 KB View Download

Comment 9 by jhawkins@chromium.org, Nov 27 

iby: Have you tried with a different (e.g., fresh test) account?

Comment 10 by jkardatzke@chromium.org, Nov 27 

You can also try with a powerwashed one...if you need another Chromebook to use...I have plenty of them.

Comment 11 by iby@chromium.org, Nov 27 

#9: Yes, after a few logins, I got a memory corruption error. It's not 100% though. I don't know if I didn't see it the first time because it's random or because it only happens on a subsequent login. 


#10: I reflashed from USB, should be about the same as a powerwash
stack_trace_login_memcorruption4
14.9 KB View Download

Comment 12 by weifangsun@chromium.org, Dec 7

Components: UI>Shell>StartScreen

Comment 13 by benhenry@google.com, Jan 11

Status: Assigned (was: Untriaged)
This issue has an owner, a component and a priority, but is still listed as untriaged or unconfirmed. By definition, this bug is triaged. Changing status to "assigned". Please reach out to me if you disagree with how I've done this.
►

Sign in to add a comment