audio_decoder_fuzzer crash stack changes after buildtools roll, close other open bugs. |
||||||
Issue descriptionThis regressed in https://chromium.googlesource.com/chromium/src/+log/4bc137c6dd5974507d858e6de28885fd8b64fcfc..9a085ba23156aba9ade0a08efd3d948f9527f01e?pretty=fuller&n=10000 ASAN_OPTIONS=redzone=16:print_suppressions=0:strict_memcmp=1:allow_user_segv_handler=0:allocator_may_return_null=1:handle_sigfpe=1:handle_sigbus=1:detect_stack_use_after_return=1:alloc_dealloc_mismatch=0:print_scariness=1:max_uar_stack_size_log=16:quarantine_size_mb=256:detect_odr_violation=0:handle_sigill=1:allocator_release_to_os_interval_ms=500:use_sigaltstack=1:fast_unwind_on_fatal=1:detect_leaks=1:print_summary=1:handle_abort=1:check_malloc_usable_size=0:detect_container_overflow=1:symbolize=1:handle_segv=1 out/lfasan/audio_decoder_fuzzer ~/Downloads/clusterfuzz-testcase-minimized-audio_decoder_fuzzer-6121389930840064 INFO: Seed: 834382748 AddressSanitizer:DEADLYSIGNAL ================================================================= ==241027==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000004e (pc 0x55cc993e27dd bp 0x7ffc25fca200 sp 0x7ffc25fca1f0 T0) ==241027==The signal is caused by a READ memory access. ==241027==Hint: address points to the zero page. SCARINESS: 10 (null-deref) #0 0x55cc993e27dc in fuzzer::FuzzingOptions::FuzzingOptions(fuzzer::FuzzingOptions const&) third_party/libFuzzer/src/FuzzerOptions.h:18 #1 0x55cc993e1a38 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:645:48 #2 0x55cc993f7f32 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10 #3 0x7f7e93bf52b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV third_party/libFuzzer/src/FuzzerOptions.h:18 in fuzzer::FuzzingOptions::FuzzingOptions(fuzzer::FuzzingOptions const&) ==241027==ABORTING Right now, the roll is reverted in https://bugs.chromium.org/p/chromium/issues/detail?id=910864#c25. Please don't reland, as this will break an unknown number of open testcases on ClusterFuzz.
,
Dec 15
you don't need the testcase, just run like
ASAN_OPTIONS=detect_odr_violation=0 out/fuzz/audio_decoder_fuzzer
INFO: Seed: 4096024004
AddressSanitizer:DEADLYSIGNAL
=================================================================
==180587==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000004e (pc 0x559264a7881d bp 0x7ffe06fd4b10 sp 0x7ffe06fd4b00 T0)
==180587==The signal is caused by a READ memory access.
==180587==Hint: address points to the zero page.
#0 0x559264a7881c in fuzzer::FuzzingOptions::FuzzingOptions(fuzzer::FuzzingOptions const&) third_party/libFuzzer/src/FuzzerOptions.h:18
#1 0x559264a77a78 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:645:48
#2 0x559264a8df72 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10
#3 0x7f62641d52b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV third_party/libFuzzer/src/FuzzerOptions.h:18 in fuzzer::FuzzingOptions::FuzzingOptions(fuzzer::FuzzingOptions const&)
==180587==ABORTING
,
Dec 15
looks like only this audio_decoder_fuzzer target is impacted, i have tried a lot of other fuzz targets like appcache_fuzzer, renderer_fuzzer, base_json_reader_fuzzer, dawn_wire_server_and_frontend_fuzzer, mediasource_ADTS_pipeline_integration_fuzzer, skia+path_fuzzers all seem to be ok. so, this bug is not scary as we expected before, looks like might be a buggy audio_decoder_fuzzer target. so, i think we might be able to reland on Monday. lets do it then to avoid any unpredicted weekend fires.
,
Dec 17
,
Dec 18
,
Dec 19
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/155ea8d1356528c9b75b136ce9c453f11c3ccda5 commit 155ea8d1356528c9b75b136ce9c453f11c3ccda5 Author: Tom Anderson <thomasanderson@chromium.org> Date: Wed Dec 19 21:34:37 2018 Instrument libfuzzer in asan builds This change prevents rolling buildtools/libc++ from breaking audio_decoder_fuzzer. BUG= 915422 R=inferno CC=metzman,mmoroz,thakis Change-Id: I4463c50c171da05308fe053ff7547b198c8130ed Reviewed-on: https://chromium-review.googlesource.com/c/1384622 Commit-Queue: Thomas Anderson <thomasanderson@chromium.org> Reviewed-by: Jonathan Metzman <metzman@chromium.org> Cr-Commit-Position: refs/heads/master@{#617955} [modify] https://crrev.com/155ea8d1356528c9b75b136ce9c453f11c3ccda5/third_party/libFuzzer/BUILD.gn
,
Dec 19
,
Dec 20
|
||||||
►
Sign in to add a comment |
||||||
Comment 1 by infe...@chromium.org
, Dec 15