New issue
Advanced search Search tips

Issue 921360 link

Starred by 1 user

Issue metadata

Status: Verified
Owner: ----
Closed: Jan 15
Cc:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug



Sign in to add a comment

Direct-leak in dawn_wire::server::Server::HandleBufferMapAsync

Project Member Reported by ClusterFuzz, Jan 13

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6207909272485888

Fuzzer: libFuzzer_dawn_wire_server_and_frontend_fuzzer
Fuzz target binary: dawn_wire_server_and_frontend_fuzzer
Job Type: chromeos_libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  dawn_wire::server::Server::HandleBufferMapAsync
  dawn_wire::server::Server::HandleCommands
  DawnWireServerAndFrontendFuzzer.cpp
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=chromeos_libfuzzer_chrome_asan&range=620458:620480

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6207909272485888

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.
 
Project Member

Comment 1 by ClusterFuzz, Jan 13

Cc: kainino@chromium.org cwallez@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 2 by bugdroid1@chromium.org, Jan 14

The following revision refers to this bug:
  https://dawn.googlesource.com/dawn/+/1a99f42c7dc6b7da25cc4e143b0b6af93bd36c4d

commit 1a99f42c7dc6b7da25cc4e143b0b6af93bd36c4d
Author: Corentin Wallez <cwallez@chromium.org>
Date: Mon Jan 14 18:41:13 2019

WireServer: Wrap userdata in unique_ptr in callbacks

This fixes a leak that was introduced in
https://dawn-review.googlesource.com/c/dawn/+/3622 where the early
return doesn't delete the userdata.

BUG= chromium:921360 

Change-Id: I500dd2b4fa02121e5c0278c5f6f83a30861815e4
Reviewed-on: https://dawn-review.googlesource.com/c/3942
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Austin Eng <enga@chromium.org>

[modify] https://crrev.com/1a99f42c7dc6b7da25cc4e143b0b6af93bd36c4d/generator/templates/dawn_wire/WireServer.cpp

Project Member

Comment 3 by bugdroid1@chromium.org, Jan 14

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0692410369582ff412054fb672f3912553eefb1c

commit 0692410369582ff412054fb672f3912553eefb1c
Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Date: Mon Jan 14 21:01:30 2019

Roll src/third_party/dawn 03f64292ad55..1a99f42c7dc6 (1 commits)

https://dawn.googlesource.com/dawn.git/+log/03f64292ad55..1a99f42c7dc6


git log 03f64292ad55..1a99f42c7dc6 --date=short --no-merges --format='%ad %ae %s'
2019-01-14 cwallez@chromium.org WireServer: Wrap userdata in unique_ptr in callbacks


Created with:
  gclient setdep -r src/third_party/dawn@1a99f42c7dc6

The AutoRoll server is located here: https://autoroll.skia.org/r/dawn-chromium-autoroll

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel

BUG= chromium:921360 
TBR=cwallez@chromium.org

Change-Id: I3807692dab3e301f64c9b25c1ae98d819a37d129
Reviewed-on: https://chromium-review.googlesource.com/c/1409592
Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#622596}
[modify] https://crrev.com/0692410369582ff412054fb672f3912553eefb1c/DEPS

Project Member

Comment 4 by ClusterFuzz, Jan 15

ClusterFuzz has detected this issue as fixed in range 622587:622639.

Detailed report: https://clusterfuzz.com/testcase?key=6207909272485888

Fuzzer: libFuzzer_dawn_wire_server_and_frontend_fuzzer
Fuzz target binary: dawn_wire_server_and_frontend_fuzzer
Job Type: chromeos_libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  dawn_wire::server::Server::HandleBufferMapAsync
  dawn_wire::server::Server::HandleCommands
  DawnWireServerAndFrontendFuzzer.cpp
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=chromeos_libfuzzer_chrome_asan&range=620458:620480
Fixed: https://clusterfuzz.com/revisions?job=chromeos_libfuzzer_chrome_asan&range=622587:622639

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6207909272485888

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Jan 15

Labels: ClusterFuzz-Verified
Status: Verified (was: Untriaged)
ClusterFuzz testcase 6207909272485888 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment