CHECK failure: !initialized_ in test_timeouts.cc |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5128388746149888 Fuzzer: libFuzzer_mediasource_WEBM_VP8_pipeline_integration_fuzzer Fuzz target binary: mediasource_WEBM_VP8_pipeline_integration_fuzzer Job Type: x86_libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: !initialized_ in test_timeouts.cc TestTimeouts::Initialize pipeline_integration_fuzzertest.cc Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=x86_libfuzzer_chrome_asan_debug&range=621242:621262 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5128388746149888 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.
,
Jan 10
Automatically adding ccs based on OWNERS file / target commit history. If this is incorrect, please add ClusterFuzz-Wrong label.
,
Jan 10
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/a72257bad57d95dbc42dc00c8ebc588e2fd8586f (Initialize base::TestTimeouts in media_pipeline_integration_fuzzer.). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Jan 10
,
Jan 10
This is failing because of the initialization I added in https://chromium-review.googlesource.com/c/chromium/src/+/1403186 is getting run once per LLVMFuzzerTestOneInput() call, and there are multiple calls happening in the same process. Adding an LLVMFuzzerInitialize() and placing the initializations there fixes things.
,
Jan 10
,
Jan 10
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/773566053973b534e62c83981368c415afec49de commit 773566053973b534e62c83981368c415afec49de Author: Wez <wez@chromium.org> Date: Thu Jan 10 19:32:47 2019 Use LLVMFuzzerInitialize() for media_pipeline_integration_fuzzer init. LLVMFuzzerInitialize() is called once at process startup, so is a better place to perform one-off initialization than in each call to LLVMFuzzerTestOneInput(). Bug: 920461 Change-Id: I420e3f10a0ac96b19695a714d4d29f889ed1f5b6 Reviewed-on: https://chromium-review.googlesource.com/c/1404563 Reviewed-by: Dale Curtis <dalecurtis@chromium.org> Commit-Queue: Wez <wez@chromium.org> Cr-Commit-Position: refs/heads/master@{#621707} [modify] https://crrev.com/773566053973b534e62c83981368c415afec49de/media/test/pipeline_integration_fuzzertest.cc
,
Jan 10
,
Jan 11
ClusterFuzz has detected this issue as fixed in range 621658:621725. Detailed report: https://clusterfuzz.com/testcase?key=5128388746149888 Fuzzer: libFuzzer_mediasource_WEBM_VP8_pipeline_integration_fuzzer Fuzz target binary: mediasource_WEBM_VP8_pipeline_integration_fuzzer Job Type: x86_libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: !initialized_ in test_timeouts.cc TestTimeouts::Initialize pipeline_integration_fuzzertest.cc Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=x86_libfuzzer_chrome_asan_debug&range=621242:621262 Fixed: https://clusterfuzz.com/revisions?job=x86_libfuzzer_chrome_asan_debug&range=621658:621725 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5128388746149888 See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jan 11
ClusterFuzz testcase 5128388746149888 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jan 14
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/5e6b36726e45714acadbe4a81272155ed06340d5 commit 5e6b36726e45714acadbe4a81272155ed06340d5 Author: Wez <wez@chromium.org> Date: Mon Jan 14 18:20:44 2019 Don't pass LLVMFuzzerInitialize() args to CommandLine. LLVMFuzzer seems to pass a bad argv, causing CommandLine switch lookup to null-dereference in some cases. Speculatively revert to initializing CommandLine with null argv & argc to determine whether that is the source of the issue. Bug: 920924, 920461 Change-Id: Idf689c53be920b15ec6593a66cb5deb4d5708f69 Reviewed-on: https://chromium-review.googlesource.com/c/1408129 Commit-Queue: Wez <wez@chromium.org> Reviewed-by: Dale Curtis <dalecurtis@chromium.org> Cr-Commit-Position: refs/heads/master@{#622516} [modify] https://crrev.com/5e6b36726e45714acadbe4a81272155ed06340d5/media/test/pipeline_integration_fuzzertest.cc |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by ClusterFuzz
, Jan 10Labels: Test-Predator-Auto-Components