New issue
Advanced search Search tips

Issue 924030 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Chrome
Pri: 1
Type: Bug



Sign in to add a comment

Abrt in base::test::ScopedTaskEnvironment::ScopedTaskEnvironment

Project Member Reported by ClusterFuzz, Today (22 hours ago)

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5651364633640960

Fuzzer: libFuzzer_media_pipeline_integration_fuzzer
Fuzz target binary: media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x053900004107
Crash State:
  base::test::ScopedTaskEnvironment::ScopedTaskEnvironment
  void base::internal::FunctorTraits<void
  void base::internal::Invoker<base::internal::BindState<void
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5651364633640960

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
 
Project Member

Comment 1 by ClusterFuzz, Today (22 hours ago)

Labels: OS-Chrome
Project Member

Comment 2 by ClusterFuzz, Today (22 hours ago)

Components: Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 3 by ClusterFuzz, Today (22 hours ago)

Cc: xhw...@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.

Comment 4 by xhw...@chromium.org, Today (11 hours ago)

Owner: w...@chromium.org
Status: Assigned (was: Untriaged)
wez: Seems to be triggering the new LOG(FATAL) you added in https://chromium-review.googlesource.com/c/chromium/src/+/1319344

Comment 5 by w...@chromium.org, Today (11 hours ago)

Owner: gab@chromium.org
This report is from Chrome ASAN, so presumably the issue is that this text takes longer than action_max_timeout(), in spite of the extra multiplier we give that under ASAN, due to instrumentation.

gab: Should we disable Run() timeouts in ADDRESS_SANITIZER builds, do you think?

xhwang: Short-term I'd suggest adding a ScopedRunTimeoutForTest instance to this fuzzer, conditional on ADDRESS_SANITIZER, to disable the Run() timeouts in that case.

Comment 6 by w...@chromium.org, Today (11 hours ago)

Cc: gab@chromium.org
Owner: w...@chromium.org

Sign in to add a comment