New issue
Advanced search Search tips

Issue 920461 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 10
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: !initialized_ in test_timeouts.cc

Project Member Reported by ClusterFuzz, Jan 10

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5128388746149888

Fuzzer: libFuzzer_mediasource_WEBM_VP8_pipeline_integration_fuzzer
Fuzz target binary: mediasource_WEBM_VP8_pipeline_integration_fuzzer
Job Type: x86_libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !initialized_ in test_timeouts.cc
  TestTimeouts::Initialize
  pipeline_integration_fuzzertest.cc
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=x86_libfuzzer_chrome_asan_debug&range=621242:621262

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5128388746149888

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.
 
Project Member

Comment 1 by ClusterFuzz, Jan 10

Components: Internals>Core Internals>Media
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jan 10

Cc: xhw...@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Jan 10

Labels: Test-Predator-Auto-Owner
Owner: w...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/a72257bad57d95dbc42dc00c8ebc588e2fd8586f (Initialize base::TestTimeouts in media_pipeline_integration_fuzzer.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Labels: -Type-Bug M-73 Type-Bug-Regression
Status: Started (was: Assigned)
Labels: -Type-Bug-Regression Type-Bug
This is failing because of the initialization I added in https://chromium-review.googlesource.com/c/chromium/src/+/1403186 is getting run once per LLVMFuzzerTestOneInput() call, and there are multiple calls happening in the same process.

Adding an LLVMFuzzerInitialize() and placing the initializations there fixes things.
Project Member

Comment 7 by bugdroid1@chromium.org, Jan 10

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/773566053973b534e62c83981368c415afec49de

commit 773566053973b534e62c83981368c415afec49de
Author: Wez <wez@chromium.org>
Date: Thu Jan 10 19:32:47 2019

Use LLVMFuzzerInitialize() for media_pipeline_integration_fuzzer init.

LLVMFuzzerInitialize() is called once at process startup, so is a better
place to perform one-off initialization than in each call to
LLVMFuzzerTestOneInput().

Bug:  920461 
Change-Id: I420e3f10a0ac96b19695a714d4d29f889ed1f5b6
Reviewed-on: https://chromium-review.googlesource.com/c/1404563
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Commit-Queue: Wez <wez@chromium.org>
Cr-Commit-Position: refs/heads/master@{#621707}
[modify] https://crrev.com/773566053973b534e62c83981368c415afec49de/media/test/pipeline_integration_fuzzertest.cc

Status: Fixed (was: Started)
Project Member

Comment 9 by ClusterFuzz, Jan 11

ClusterFuzz has detected this issue as fixed in range 621658:621725.

Detailed report: https://clusterfuzz.com/testcase?key=5128388746149888

Fuzzer: libFuzzer_mediasource_WEBM_VP8_pipeline_integration_fuzzer
Fuzz target binary: mediasource_WEBM_VP8_pipeline_integration_fuzzer
Job Type: x86_libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !initialized_ in test_timeouts.cc
  TestTimeouts::Initialize
  pipeline_integration_fuzzertest.cc
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=x86_libfuzzer_chrome_asan_debug&range=621242:621262
Fixed: https://clusterfuzz.com/revisions?job=x86_libfuzzer_chrome_asan_debug&range=621658:621725

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5128388746149888

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Jan 11

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5128388746149888 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 11 by bugdroid1@chromium.org, Jan 14

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5e6b36726e45714acadbe4a81272155ed06340d5

commit 5e6b36726e45714acadbe4a81272155ed06340d5
Author: Wez <wez@chromium.org>
Date: Mon Jan 14 18:20:44 2019

Don't pass LLVMFuzzerInitialize() args to CommandLine.

LLVMFuzzer seems to pass a bad argv, causing CommandLine switch lookup
to null-dereference in some cases.

Speculatively revert to initializing CommandLine with null argv & argc
to determine whether that is the source of the issue.

Bug: 920924,  920461 
Change-Id: Idf689c53be920b15ec6593a66cb5deb4d5708f69
Reviewed-on: https://chromium-review.googlesource.com/c/1408129
Commit-Queue: Wez <wez@chromium.org>
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#622516}
[modify] https://crrev.com/5e6b36726e45714acadbe4a81272155ed06340d5/media/test/pipeline_integration_fuzzertest.cc

Sign in to add a comment