From 6c996485f4c3629803e203437223d798de3f4bf3 Mon Sep 17 00:00:00 2001 From: George Pollard Date: Mon, 17 Apr 2023 22:24:10 +0000 Subject: [PATCH 1/2] Use insta for snapshot tests --- src/agent/Cargo.lock | 79 ++++++++++ .../data/parsed-traces/android_asan_uaf.json | 16 -- ...on => check_dir@address_in_state.txt.snap} | 5 + ...droid_asan_null_dereference_read.txt.snap} | 5 + ...roid_asan_null_dereference_write.txt.snap} | 5 + ...ck_dir@android_asan_unknown_read.txt.snap} | 5 + ...k_dir@android_asan_unknown_write.txt.snap} | 5 + ...=> check_dir@asan_assert_failure.txt.snap} | 5 + ...son => check_dir@asan_breakpoint.txt.snap} | 5 + ...k_dir@asan_breakpoint_with_check.txt.snap} | 5 + ...n_bus.json => check_dir@asan_bus.txt.snap} | 5 + ...dir@asan_container_overflow_read.txt.snap} | 5 + ...on => check_dir@asan_double_free.txt.snap} | 5 + ...n_fpe.json => check_dir@asan_fpe.txt.snap} | 5 + ...l.json => check_dir@asan_gsignal.txt.snap} | 5 + ...heck_dir@asan_heap_overflow_read.txt.snap} | 5 + ...eck_dir@asan_heap_overflow_write.txt.snap} | 5 + ...n_ill.json => check_dir@asan_ill.txt.snap} | 5 + ... check_dir@asan_ill_null_address.txt.snap} | 5 + ...n => check_dir@asan_invalid_free.txt.snap} | 5 + ...k_dir@asan_null_dereference_read.txt.snap} | 5 + ...ir@asan_null_dereference_unknown.txt.snap} | 5 + ...r@asan_null_dereference_win_read.txt.snap} | 5 + ...@asan_null_dereference_win_write.txt.snap} | 5 + ..._dir@asan_null_dereference_write.txt.snap} | 5 + ...=> check_dir@asan_stack_overflow.txt.snap} | 5 + ...> check_dir@asan_stack_overflow2.txt.snap} | 5 + ...> check_dir@asan_stack_overflow3.txt.snap} | 5 + ...n_uaf.json => check_dir@asan_uaf.txt.snap} | 5 + ...heck_dir@asan_unknown_crash_read.txt.snap} | 5 + ...eck_dir@asan_unknown_crash_write.txt.snap} | 5 + ...n => check_dir@asan_unknown_read.txt.snap} | 5 + ...> check_dir@asan_unknown_unknown.txt.snap} | 5 + ... check_dir@asan_unknown_win_read.txt.snap} | 5 + ...check_dir@asan_unknown_win_write.txt.snap} | 5 + ... => check_dir@asan_unknown_write.txt.snap} | 5 + ...{assert.json => check_dir@assert.txt.snap} | 5 + ...=> check_dir@assert_chromium_log.txt.snap} | 5 + ... check_dir@assert_failure_google.txt.snap} | 5 + ...c.json => check_dir@assert_glibc.txt.snap} | 5 + ...check_dir@assert_glibc_with_glib.txt.snap} | 5 + ...ck_dir@assert_with_panic_keyword.txt.snap} | 5 + ...af.json => check_dir@browser_uaf.txt.snap} | 5 + ...2.json => check_dir@browser_uaf2.txt.snap} | 5 + ...3.json => check_dir@browser_uaf3.txt.snap} | 5 + ...t.json => check_dir@cfi_bad_cast.txt.snap} | 5 + ...> check_dir@check_failure_google.txt.snap} | 5 + ..._dir@check_failure_vs_no_closing.txt.snap} | 5 + ...eck_failure_with_handle_sigill=1.txt.snap} | 5 + ...dir@check_failure_with_msan_abrt.txt.snap} | 5 + ...ck_failure_with_string_vs_string.txt.snap} | 5 + ...k.json => check_dir@cobalt_check.txt.snap} | 5 + ...n.json => check_dir@fuchsia_asan.txt.snap} | 5 + ...json => check_dir@fuchsia_ignore.txt.snap} | 5 + ...k_dir@fuchsia_reproducible_crash.txt.snap} | 5 + ...ck_dir@gdb_sigtrap_and_libfuzzer.txt.snap} | 5 + ...=> check_dir@glib_assert_failure.txt.snap} | 5 + ...n => check_dir@golang_asan_panic.txt.snap} | 5 + ...olang_fatal_error_stack_overflow.txt.snap} | 5 + ...eneric_fatal_error_and_asan_abrt.txt.snap} | 5 + ...lang_generic_panic_and_asan_abrt.txt.snap} | 5 + ...check_dir@golang_libfuzzer_panic.txt.snap} | 5 + ...ang_new_crash_type_and_asan_abrt.txt.snap} | 5 + ...ror_index_out_of_range_with_msan.txt.snap} | 5 + ..._error_slice_bounds_out_of_range.txt.snap} | 5 + ...dir@gsignal_at_first_stack_frame.txt.snap} | 5 + ...asan_allocation_tail_overwritten.txt.snap} | 5 + ...=> check_dir@ignore_abort_frames.txt.snap} | 5 + ...on => check_dir@ignore_honggfuzz.txt.snap} | 5 + ...=> check_dir@ignore_libcplusplus.txt.snap} | 5 + ...vm.json => check_dir@ignore_llvm.txt.snap} | 5 + ...on => check_dir@ignore_sanitizer.txt.snap} | 5 + ...so.json => check_dir@ignore_vdso.txt.snap} | 5 + ...n => check_dir@ignore_win_frames.txt.snap} | 5 + ...heck_dir@libfuzzer_deadly_signal.txt.snap} | 5 + ...dir@libfuzzer_fuzz_target_exited.txt.snap} | 5 + ...llvm_fuzzer_test_one_input_crash.txt.snap} | 5 + ....json => check_dir@libfuzzer_oom.txt.snap} | 5 + ...> check_dir@libfuzzer_oom_malloc.txt.snap} | 5 + ...libfuzzer_overwrites_const_input.txt.snap} | 5 + ...n => check_dir@libfuzzer_timeout.txt.snap} | 5 + ....json => check_dir@lkl_libfuzzer.txt.snap} | 5 + ...eck_dir@lkl_libfuzzer_symbolized.txt.snap} | 5 + ...k_dir@lkl_libfuzzer_unsymbolized.txt.snap} | 5 + ...on => check_dir@log_fatal_google.txt.snap} | 5 + ...on => check_dir@lsan_direct_leak.txt.snap} | 5 + ...eck_dir@lsan_indirect_leak_cycle.txt.snap} | 5 + ...=> check_dir@lsan_multiple_leaks.txt.snap} | 5 + ...eck_dir@lsan_single_frame_stacks.txt.snap} | 5 + ...r.json => check_dir@msan_browser.txt.snap} | 5 + ....json => check_dir@msan_renderer.txt.snap} | 5 + ...eck_dir@msan_uninitialized_value.txt.snap} | 5 + .../{oom2.json => check_dir@oom2.txt.snap} | 5 + .../{oom3.json => check_dir@oom3.txt.snap} | 5 + .../{oom4.json => check_dir@oom4.txt.snap} | 5 + ...k_dir@python_unhandled_exception.txt.snap} | 5 + ...check_dir@regress_double_unknown.txt.snap} | 5 + ...rt.json => check_dir@rust_assert.txt.snap} | 5 + ...s.json => check_dir@rust_ignores.txt.snap} | 5 + ...t_oom.json => check_dir@rust_oom.txt.snap} | 5 + ... check_dir@sanitizer_signal_abrt.txt.snap} | 5 + ...ir@sanitizer_signal_abrt_unknown.txt.snap} | 5 + ...ecurity_dcheck_failure_with_abrt.txt.snap} | 5 + ... => check_dir@swift_invalid_free.txt.snap} | 5 + ...symbolized_asan_null_dereference.txt.snap} | 5 + ...heck_dir@symbolized_asan_unknown.txt.snap} | 5 + ...json => check_dir@tsan_data_race.txt.snap} | 5 + ...=> check_dir@tsan_use_after_free.txt.snap} | 5 + ...k_dir@ubsan_bad_cast_member_call.txt.snap} | 5 + ...> check_dir@ubsan_divide_by_zero.txt.snap} | 5 + ..._fpe.json => check_dir@ubsan_fpe.txt.snap} | 5 + ..._ill.json => check_dir@ubsan_ill.txt.snap} | 5 + ..._incorrect_function_pointer_type.txt.snap} | 5 + ...son => check_dir@ubsan_index_oob.txt.snap} | 5 + ...@ubsan_integer_overflow_negation.txt.snap} | 5 + ...eck_dir@ubsan_invalid_bool_value.txt.snap} | 5 + ...eck_dir@ubsan_misaligned_address.txt.snap} | 5 + ...ubsan_null_pointer_member_access.txt.snap} | 5 + ...heck_dir@ubsan_null_pointer_read.txt.snap} | 5 + ...n_null_pointer_reference_binding.txt.snap} | 5 + ...eck_dir@ubsan_null_pointer_write.txt.snap} | 5 + ...ter_overflow_null_nonzero_offset.txt.snap} | 5 + ...ointer_overflow_null_zero_offset.txt.snap} | 5 + ...eck_dir@ubsan_unknown_logs_error.txt.snap} | 5 + ...json => check_dir@unknown_module.txt.snap} | 5 + ...> check_dir@v8_abort_with_source.txt.snap} | 5 + ...heck_dir@v8_abort_without_source.txt.snap} | 5 + ...check_dir@v8_check_no_sourcefile.txt.snap} | 5 + ...=> check_dir@v8_check_symbolized.txt.snap} | 5 + ....json => check_dir@v8_check_trap.txt.snap} | 5 + ...> check_dir@v8_dcheck_symbolized.txt.snap} | 5 + ...json => check_dir@v8_process_oom.txt.snap} | 5 + ... check_dir@variable_length_write.txt.snap} | 5 + ..._dir@windows_asan_divide_by_zero.txt.snap} | 5 + ...crash.json => check_dir@wtfcrash.txt.snap} | 5 + src/agent/stacktrace-parser/Cargo.toml | 1 + ...check-failure-missing-symbolizer.txt.snap} | 5 + ... => check_dir@asan-check-failure.txt.snap} | 5 + ... => check_dir@asan-odr-violation.txt.snap} | 5 + ...eck_dir@clang-10-asan-breakpoint.txt.snap} | 5 + ...net-nested-exception-linenumbers.txt.snap} | 5 + ...k_dir@dotnet-unhandled-exception.txt.snap} | 5 + ....json => check_dir@format-string.txt.snap} | 5 + ... => check_dir@libfuzzer-asan-log.txt.snap} | 5 + ...heck_dir@libfuzzer-deadly-signal.txt.snap} | 5 + ...inux-llvm10-out-of-memory-malloc.txt.snap} | 5 + ...r-linux-llvm10-out-of-memory-rss.txt.snap} | 5 + ...ir@libfuzzer-scariness-underflow.txt.snap} | 5 + ...=> check_dir@libfuzzer-scariness.txt.snap} | 5 + ...dows-llvm10-out-of-memory-malloc.txt.snap} | 5 + ...windows-llvm10-out-of-memory-rss.txt.snap} | 5 + ..._dir@tsan-linux-llvm10-data-race.txt.snap} | 5 + src/agent/stacktrace-parser/src/lib.rs | 139 ++++++++---------- 153 files changed, 886 insertions(+), 94 deletions(-) delete mode 100644 src/agent/libclusterfuzz/data/parsed-traces/android_asan_uaf.json rename src/agent/libclusterfuzz/data/parsed-traces/{address_in_state.json => check_dir@address_in_state.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{android_asan_null_dereference_read.json => check_dir@android_asan_null_dereference_read.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{android_asan_null_dereference_write.json => check_dir@android_asan_null_dereference_write.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{android_asan_unknown_read.json => check_dir@android_asan_unknown_read.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{android_asan_unknown_write.json => check_dir@android_asan_unknown_write.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_assert_failure.json => check_dir@asan_assert_failure.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_breakpoint.json => check_dir@asan_breakpoint.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_breakpoint_with_check.json => check_dir@asan_breakpoint_with_check.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_bus.json => check_dir@asan_bus.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_container_overflow_read.json => check_dir@asan_container_overflow_read.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_double_free.json => check_dir@asan_double_free.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_fpe.json => check_dir@asan_fpe.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_gsignal.json => check_dir@asan_gsignal.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_heap_overflow_read.json => check_dir@asan_heap_overflow_read.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_heap_overflow_write.json => check_dir@asan_heap_overflow_write.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_ill.json => check_dir@asan_ill.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_ill_null_address.json => check_dir@asan_ill_null_address.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_invalid_free.json => check_dir@asan_invalid_free.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_null_dereference_read.json => check_dir@asan_null_dereference_read.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_null_dereference_unknown.json => check_dir@asan_null_dereference_unknown.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_null_dereference_win_read.json => check_dir@asan_null_dereference_win_read.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_null_dereference_win_write.json => check_dir@asan_null_dereference_win_write.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_null_dereference_write.json => check_dir@asan_null_dereference_write.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_stack_overflow.json => check_dir@asan_stack_overflow.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_stack_overflow2.json => check_dir@asan_stack_overflow2.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_stack_overflow3.json => check_dir@asan_stack_overflow3.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_uaf.json => check_dir@asan_uaf.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_unknown_crash_read.json => check_dir@asan_unknown_crash_read.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_unknown_crash_write.json => check_dir@asan_unknown_crash_write.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_unknown_read.json => check_dir@asan_unknown_read.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_unknown_unknown.json => check_dir@asan_unknown_unknown.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_unknown_win_read.json => check_dir@asan_unknown_win_read.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_unknown_win_write.json => check_dir@asan_unknown_win_write.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{asan_unknown_write.json => check_dir@asan_unknown_write.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{assert.json => check_dir@assert.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{assert_chromium_log.json => check_dir@assert_chromium_log.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{assert_failure_google.json => check_dir@assert_failure_google.txt.snap} (96%) rename src/agent/libclusterfuzz/data/parsed-traces/{assert_glibc.json => check_dir@assert_glibc.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{assert_glibc_with_glib.json => check_dir@assert_glibc_with_glib.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{assert_with_panic_keyword.json => check_dir@assert_with_panic_keyword.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{browser_uaf.json => check_dir@browser_uaf.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{browser_uaf2.json => check_dir@browser_uaf2.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{browser_uaf3.json => check_dir@browser_uaf3.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{cfi_bad_cast.json => check_dir@cfi_bad_cast.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{check_failure_google.json => check_dir@check_failure_google.txt.snap} (96%) rename src/agent/libclusterfuzz/data/parsed-traces/{check_failure_vs_no_closing.json => check_dir@check_failure_vs_no_closing.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{check_failure_with_handle_sigill=1.json => check_dir@check_failure_with_handle_sigill=1.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{check_failure_with_msan_abrt.json => check_dir@check_failure_with_msan_abrt.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{check_failure_with_string_vs_string.json => check_dir@check_failure_with_string_vs_string.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{cobalt_check.json => check_dir@cobalt_check.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{fuchsia_asan.json => check_dir@fuchsia_asan.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{fuchsia_ignore.json => check_dir@fuchsia_ignore.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{fuchsia_reproducible_crash.json => check_dir@fuchsia_reproducible_crash.txt.snap} (97%) rename src/agent/libclusterfuzz/data/parsed-traces/{gdb_sigtrap_and_libfuzzer.json => check_dir@gdb_sigtrap_and_libfuzzer.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{glib_assert_failure.json => check_dir@glib_assert_failure.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{golang_asan_panic.json => check_dir@golang_asan_panic.txt.snap} (96%) rename src/agent/libclusterfuzz/data/parsed-traces/{golang_fatal_error_stack_overflow.json => check_dir@golang_fatal_error_stack_overflow.txt.snap} (96%) rename src/agent/libclusterfuzz/data/parsed-traces/{golang_generic_fatal_error_and_asan_abrt.json => check_dir@golang_generic_fatal_error_and_asan_abrt.txt.snap} (92%) rename src/agent/libclusterfuzz/data/parsed-traces/{golang_generic_panic_and_asan_abrt.json => check_dir@golang_generic_panic_and_asan_abrt.txt.snap} (92%) rename src/agent/libclusterfuzz/data/parsed-traces/{golang_libfuzzer_panic.json => check_dir@golang_libfuzzer_panic.txt.snap} (85%) rename src/agent/libclusterfuzz/data/parsed-traces/{golang_new_crash_type_and_asan_abrt.json => check_dir@golang_new_crash_type_and_asan_abrt.txt.snap} (92%) rename src/agent/libclusterfuzz/data/parsed-traces/{golang_panic_runtime_error_index_out_of_range_with_msan.json => check_dir@golang_panic_runtime_error_index_out_of_range_with_msan.txt.snap} (92%) rename src/agent/libclusterfuzz/data/parsed-traces/{golang_panic_runtime_error_slice_bounds_out_of_range.json => check_dir@golang_panic_runtime_error_slice_bounds_out_of_range.txt.snap} (94%) rename src/agent/libclusterfuzz/data/parsed-traces/{gsignal_at_first_stack_frame.json => check_dir@gsignal_at_first_stack_frame.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{hwasan_allocation_tail_overwritten.json => check_dir@hwasan_allocation_tail_overwritten.txt.snap} (95%) rename src/agent/libclusterfuzz/data/parsed-traces/{ignore_abort_frames.json => check_dir@ignore_abort_frames.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{ignore_honggfuzz.json => check_dir@ignore_honggfuzz.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{ignore_libcplusplus.json => check_dir@ignore_libcplusplus.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{ignore_llvm.json => check_dir@ignore_llvm.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{ignore_sanitizer.json => check_dir@ignore_sanitizer.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{ignore_vdso.json => check_dir@ignore_vdso.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{ignore_win_frames.json => check_dir@ignore_win_frames.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{libfuzzer_deadly_signal.json => check_dir@libfuzzer_deadly_signal.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{libfuzzer_fuzz_target_exited.json => check_dir@libfuzzer_fuzz_target_exited.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{libfuzzer_llvm_fuzzer_test_one_input_crash.json => check_dir@libfuzzer_llvm_fuzzer_test_one_input_crash.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{libfuzzer_oom.json => check_dir@libfuzzer_oom.txt.snap} (97%) rename src/agent/libclusterfuzz/data/parsed-traces/{libfuzzer_oom_malloc.json => check_dir@libfuzzer_oom_malloc.txt.snap} (97%) rename src/agent/libclusterfuzz/data/parsed-traces/{libfuzzer_overwrites_const_input.json => check_dir@libfuzzer_overwrites_const_input.txt.snap} (97%) rename src/agent/libclusterfuzz/data/parsed-traces/{libfuzzer_timeout.json => check_dir@libfuzzer_timeout.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{lkl_libfuzzer.json => check_dir@lkl_libfuzzer.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{lkl_libfuzzer_symbolized.json => check_dir@lkl_libfuzzer_symbolized.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{lkl_libfuzzer_unsymbolized.json => check_dir@lkl_libfuzzer_unsymbolized.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{log_fatal_google.json => check_dir@log_fatal_google.txt.snap} (96%) rename src/agent/libclusterfuzz/data/parsed-traces/{lsan_direct_leak.json => check_dir@lsan_direct_leak.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{lsan_indirect_leak_cycle.json => check_dir@lsan_indirect_leak_cycle.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{lsan_multiple_leaks.json => check_dir@lsan_multiple_leaks.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{lsan_single_frame_stacks.json => check_dir@lsan_single_frame_stacks.txt.snap} (92%) rename src/agent/libclusterfuzz/data/parsed-traces/{msan_browser.json => check_dir@msan_browser.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{msan_renderer.json => check_dir@msan_renderer.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{msan_uninitialized_value.json => check_dir@msan_uninitialized_value.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{oom2.json => check_dir@oom2.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{oom3.json => check_dir@oom3.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{oom4.json => check_dir@oom4.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{python_unhandled_exception.json => check_dir@python_unhandled_exception.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{regress_double_unknown.json => check_dir@regress_double_unknown.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{rust_assert.json => check_dir@rust_assert.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{rust_ignores.json => check_dir@rust_ignores.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{rust_oom.json => check_dir@rust_oom.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{sanitizer_signal_abrt.json => check_dir@sanitizer_signal_abrt.txt.snap} (81%) rename src/agent/libclusterfuzz/data/parsed-traces/{sanitizer_signal_abrt_unknown.json => check_dir@sanitizer_signal_abrt_unknown.txt.snap} (93%) rename src/agent/libclusterfuzz/data/parsed-traces/{security_dcheck_failure_with_abrt.json => check_dir@security_dcheck_failure_with_abrt.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{swift_invalid_free.json => check_dir@swift_invalid_free.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{symbolized_asan_null_dereference.json => check_dir@symbolized_asan_null_dereference.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{symbolized_asan_unknown.json => check_dir@symbolized_asan_unknown.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{tsan_data_race.json => check_dir@tsan_data_race.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{tsan_use_after_free.json => check_dir@tsan_use_after_free.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_bad_cast_member_call.json => check_dir@ubsan_bad_cast_member_call.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_divide_by_zero.json => check_dir@ubsan_divide_by_zero.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_fpe.json => check_dir@ubsan_fpe.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_ill.json => check_dir@ubsan_ill.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_incorrect_function_pointer_type.json => check_dir@ubsan_incorrect_function_pointer_type.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_index_oob.json => check_dir@ubsan_index_oob.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_integer_overflow_negation.json => check_dir@ubsan_integer_overflow_negation.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_invalid_bool_value.json => check_dir@ubsan_invalid_bool_value.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_misaligned_address.json => check_dir@ubsan_misaligned_address.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_null_pointer_member_access.json => check_dir@ubsan_null_pointer_member_access.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_null_pointer_read.json => check_dir@ubsan_null_pointer_read.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_null_pointer_reference_binding.json => check_dir@ubsan_null_pointer_reference_binding.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_null_pointer_write.json => check_dir@ubsan_null_pointer_write.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_pointer_overflow_null_nonzero_offset.json => check_dir@ubsan_pointer_overflow_null_nonzero_offset.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_pointer_overflow_null_zero_offset.json => check_dir@ubsan_pointer_overflow_null_zero_offset.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{ubsan_unknown_logs_error.json => check_dir@ubsan_unknown_logs_error.txt.snap} (95%) rename src/agent/libclusterfuzz/data/parsed-traces/{unknown_module.json => check_dir@unknown_module.txt.snap} (81%) rename src/agent/libclusterfuzz/data/parsed-traces/{v8_abort_with_source.json => check_dir@v8_abort_with_source.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{v8_abort_without_source.json => check_dir@v8_abort_without_source.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{v8_check_no_sourcefile.json => check_dir@v8_check_no_sourcefile.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{v8_check_symbolized.json => check_dir@v8_check_symbolized.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{v8_check_trap.json => check_dir@v8_check_trap.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{v8_dcheck_symbolized.json => check_dir@v8_dcheck_symbolized.txt.snap} (98%) rename src/agent/libclusterfuzz/data/parsed-traces/{v8_process_oom.json => check_dir@v8_process_oom.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{variable_length_write.json => check_dir@variable_length_write.txt.snap} (96%) rename src/agent/libclusterfuzz/data/parsed-traces/{windows_asan_divide_by_zero.json => check_dir@windows_asan_divide_by_zero.txt.snap} (99%) rename src/agent/libclusterfuzz/data/parsed-traces/{wtfcrash.json => check_dir@wtfcrash.txt.snap} (99%) rename src/agent/stacktrace-parser/data/parsed-traces/{asan-check-failure-missing-symbolizer.json => check_dir@asan-check-failure-missing-symbolizer.txt.snap} (98%) rename src/agent/stacktrace-parser/data/parsed-traces/{asan-check-failure.json => check_dir@asan-check-failure.txt.snap} (98%) rename src/agent/stacktrace-parser/data/parsed-traces/{asan-odr-violation.json => check_dir@asan-odr-violation.txt.snap} (94%) rename src/agent/stacktrace-parser/data/parsed-traces/{clang-10-asan-breakpoint.json => check_dir@clang-10-asan-breakpoint.txt.snap} (99%) rename src/agent/stacktrace-parser/data/parsed-traces/{dotnet-nested-exception-linenumbers.json => check_dir@dotnet-nested-exception-linenumbers.txt.snap} (97%) rename src/agent/stacktrace-parser/data/parsed-traces/{dotnet-unhandled-exception.json => check_dir@dotnet-unhandled-exception.txt.snap} (98%) rename src/agent/stacktrace-parser/data/parsed-traces/{format-string.json => check_dir@format-string.txt.snap} (72%) rename src/agent/stacktrace-parser/data/parsed-traces/{libfuzzer-asan-log.json => check_dir@libfuzzer-asan-log.txt.snap} (98%) rename src/agent/stacktrace-parser/data/parsed-traces/{libfuzzer-deadly-signal.json => check_dir@libfuzzer-deadly-signal.txt.snap} (98%) rename src/agent/stacktrace-parser/data/parsed-traces/{libfuzzer-linux-llvm10-out-of-memory-malloc.json => check_dir@libfuzzer-linux-llvm10-out-of-memory-malloc.txt.snap} (98%) rename src/agent/stacktrace-parser/data/parsed-traces/{libfuzzer-linux-llvm10-out-of-memory-rss.json => check_dir@libfuzzer-linux-llvm10-out-of-memory-rss.txt.snap} (95%) rename src/agent/stacktrace-parser/data/parsed-traces/{libfuzzer-scariness-underflow.json => check_dir@libfuzzer-scariness-underflow.txt.snap} (98%) rename src/agent/stacktrace-parser/data/parsed-traces/{libfuzzer-scariness.json => check_dir@libfuzzer-scariness.txt.snap} (98%) rename src/agent/stacktrace-parser/data/parsed-traces/{libfuzzer-windows-llvm10-out-of-memory-malloc.json => check_dir@libfuzzer-windows-llvm10-out-of-memory-malloc.txt.snap} (98%) rename src/agent/stacktrace-parser/data/parsed-traces/{libfuzzer-windows-llvm10-out-of-memory-rss.json => check_dir@libfuzzer-windows-llvm10-out-of-memory-rss.txt.snap} (77%) rename src/agent/stacktrace-parser/data/parsed-traces/{tsan-linux-llvm10-data-race.json => check_dir@tsan-linux-llvm10-data-race.txt.snap} (86%) diff --git a/src/agent/Cargo.lock b/src/agent/Cargo.lock index 5c230b5bf5..0683c67526 100644 --- a/src/agent/Cargo.lock +++ b/src/agent/Cargo.lock @@ -312,6 +312,16 @@ dependencies = [ "arrayvec 0.7.2", ] +[[package]] +name = "bstr" +version = "1.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c3d4260bcc2e8fc9df1eac4919a720effeb63a3f0952f5bf4944adfa18897f09" +dependencies = [ + "memchr", + "serde", +] + [[package]] name = "bumpalo" version = "3.11.1" @@ -461,6 +471,18 @@ dependencies = [ "serde", ] +[[package]] +name = "console" +version = "0.15.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c3d79fbe8970a77e3e34151cc13d3b3e248aa0faaecb9f6091fa07ebefe5ad60" +dependencies = [ + "encode_unicode", + "lazy_static", + "libc", + "windows-sys 0.42.0", +] + [[package]] name = "core-foundation" version = "0.9.3" @@ -800,6 +822,12 @@ dependencies = [ "stable_deref_trait", ] +[[package]] +name = "encode_unicode" +version = "0.3.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f" + [[package]] name = "encoding_rs" version = "0.8.28" @@ -1170,6 +1198,19 @@ version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9b919933a397b79c37e33b77bb2aa3dc8eb6e165ad809e58ff75bc7db2e34574" +[[package]] +name = "globset" +version = "0.4.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "029d74589adefde59de1a0c4f4732695c32805624aec7b68d91503d4dba79afc" +dependencies = [ + "aho-corasick", + "bstr", + "fnv", + "log", + "regex", +] + [[package]] name = "goblin" version = "0.5.1" @@ -1447,6 +1488,22 @@ dependencies = [ "winapi 0.3.9", ] +[[package]] +name = "insta" +version = "1.29.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9a28d25139df397cbca21408bb742cf6837e04cdbebf1b07b760caf971d6a972" +dependencies = [ + "console", + "globset", + "lazy_static", + "linked-hash-map", + "serde", + "similar", + "walkdir", + "yaml-rust", +] + [[package]] name = "instant" version = "0.1.11" @@ -1635,6 +1692,12 @@ dependencies = [ "libc", ] +[[package]] +name = "linked-hash-map" +version = "0.5.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f" + [[package]] name = "linux-raw-sys" version = "0.1.4" @@ -2984,6 +3047,12 @@ dependencies = [ "libc", ] +[[package]] +name = "similar" +version = "2.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "420acb44afdae038210c99e69aae24109f32f15500aa708e81d46c9f29d55fcf" + [[package]] name = "siphasher" version = "0.3.7" @@ -3090,6 +3159,7 @@ version = "0.1.0" dependencies = [ "anyhow", "hex", + "insta", "lazy_static", "libclusterfuzz", "pretty_assertions", @@ -4028,6 +4098,15 @@ dependencies = [ "tap", ] +[[package]] +name = "yaml-rust" +version = "0.4.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85" +dependencies = [ + "linked-hash-map", +] + [[package]] name = "yansi" version = "0.5.1" diff --git a/src/agent/libclusterfuzz/data/parsed-traces/android_asan_uaf.json b/src/agent/libclusterfuzz/data/parsed-traces/android_asan_uaf.json deleted file mode 100644 index 3267b86064..0000000000 --- a/src/agent/libclusterfuzz/data/parsed-traces/android_asan_uaf.json +++ /dev/null @@ -1,16 +0,0 @@ -{ - "text": "==378==ERROR: AddressSanitizer: heap-use-after-free on address 0xac80d400 at pc 0xaf036288 bp 0xac9ff740 sp 0xac9ff30c\n\n\nREAD of size 2 at 0xac80d400 thread T27 (NuCachedSource2)\n\n #0 0xaf036287 in strlen\n\n #1 0xaef0a307 in __strlen_chk bionic/libc/bionic/fortify.cpp:313:16\n\n #2 0xaf9f961d in strlen bionic/libc/include/string.h:325:12\n #3 0xaf9f961d in android::AString::setTo(char const*) frameworks/av/media/libstagefright/foundation/AString.cpp:112\n #4 0xaf9f961d in android::AString::AString(char const*) frameworks/av/media/libstagefright/foundation/AString.cpp:50\n\n #5 0xaf755afb in android::MediaHTTP::connect(char const*, android::KeyedVector const*, long long) frameworks/av/media/libstagefright/http/MediaHTTP.cpp:69:44\n\n #6 0xaf755e23 in android::MediaHTTP::reconnectAtOffset(long long) frameworks/av/media/libstagefright/http/MediaHTTP.cpp:148:12\n\n #7 0xaf757563 in android::NuCachedSource2::fetchInternal() frameworks/av/media/libstagefright/NuCachedSource2.cpp:339:13\n\n #8 0xaf757253 in android::NuCachedSource2::onFetch() frameworks/av/media/libstagefright/NuCachedSource2.cpp:415:9\n\n #9 0xaf758419 in android::AHandlerReflector::onMessageReceived(android::sp const&) frameworks/av/include/media/stagefright/foundation/AHandlerReflector.h:35:13\n\n #10 0xaf9f37d5 in android::AHandler::deliverMessage(android::sp const&) frameworks/av/media/libstagefright/foundation/AHandler.cpp:27:5\n\n #11 0xaf9f5b35 in android::AMessage::deliver() frameworks/av/media/libstagefright/foundation/AMessage.cpp:382:5\n\n #12 0xaf9f440b in android::ALooper::loop() frameworks/av/media/libstagefright/foundation/ALooper.cpp:220:5\n\n #13 0xaf82da85 in android::Thread::_threadLoop(void*) system/core/libutils/Threads.cpp:754:22\n\n #14 0xaef376c3 in __pthread_start(void*) bionic/libc/bionic/pthread_create.cpp:198:18\n\n #15 0xaef091cf in __start_thread bionic/libc/bionic/clone.cpp:41:16\n\n\n\n0xac80d400 is located 0 bytes inside of 64-byte region [0xac80d400,0xac80d440)\n\nfreed by thread T27 (NuCachedSource2) here:\n\n #0 0xaf04a90f in __interceptor_free\n\n #1 0xaf9f966b in android::AString::clear() frameworks/av/media/libstagefright/foundation/AString.cpp:129:9\n\n\n\npreviously allocated by thread T26 (generic) here:\n\n #0 0xaf04afff in __interceptor_realloc\n\n #1 0xaf9f986b in android::AString::append(char const*, unsigned int) frameworks/av/media/libstagefright/foundation/AString.cpp:195:25\n\n\n\nThread T27 (NuCachedSource2) created by T26 (generic) here:\n\n #0 0xaf0324db in pthread_create\n\n #1 0xaf82d641 in androidCreateRawThreadEtc system/core/libutils/Threads.cpp:160:18\n\n\n\nThread T26 (generic) created by T25 (NuPlayerDriver ) here:\n\n #0 0xaf0324db in pthread_create\n\n #1 0xaf82d641 in androidCreateRawThreadEtc system/core/libutils/Threads.cpp:160:18\n\n\n\nThread T25 (NuPlayerDriver ) created by T2 (Binder:378_2) here:\n\n #0 0xaf0324db in pthread_create\n\n #1 0xaf82d641 in androidCreateRawThreadEtc system/core/libutils/Threads.cpp:160:18\n\n\n\nThread T2 (Binder:378_2) created by T1 (Binder:378_1) here:\n\n #0 0xaf0324db in pthread_create\n\n #1 0xaf82d641 in androidCreateRawThreadEtc system/core/libutils/Threads.cpp:160:18\n\n\n\nThread T1 (Binder:378_1) created by T0 here:\n\n #0 0xaf0324db in pthread_create\n\n #1 0xaf82d641 in androidCreateRawThreadEtc system/core/libutils/Threads.cpp:160:18\n\n #2 0xaef061b1 in __libc_init bionic/libc/bionic/libc_init_dynamic.cpp:109:8\n\n #3 0xffffffff ()\n\n\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/system/lib/libclang_rt.asan-arm-android.so+0x60287)\n\nShadow bytes around the buggy address:\n 0x15901a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x15901a40: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa\n 0x15901a50: 00 00 00 00 00 00 04 fa fa fa fa fa 00 00 00 00\n 0x15901a60: 00 00 04 fa fa fa fa fa 00 00 00 00 00 00 00 fa\n 0x15901a70: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa\n=>0x15901a80:[fd]fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd\n 0x15901a90: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 04\n 0x15901aa0: fa fa fa fa 00 00 00 00 00 00 02 fa fa fa fa fa\n 0x15901ab0: fd fd fd fd fd fd fd fd fa fa fa fa 00 00 00 00\n 0x15901ac0: 00 00 00 04 fa fa fa fa fd fd fd fd fd fd fd fd\n 0x15901ad0: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap left redzone: fa\n Heap right redzone: fb\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack partial redzone: f4\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n\n==378==ABORTING\n\n--------- ServiceManager (284):\nservice 'media.resource_manager' died\nservice 'media.player' died\n--------- IMediaDeathNotifier (5901):\nmedia server died\nerror (100, 0)\nError (100,0)\n--------- mediaserver (5950):\nServiceManager: 0xab607e40", - "sanitizer": "AddressSanitizer", - "summary": "AddressSanitizer: heap-use-after-free (/system/lib/libclang_rt.asan-arm-android.so+0x60287)", - "fault_type": "heap-use-after-free", - "call_stack": [ - "#0 0xaf036287 in strlen" - ], - "full_stack_details": [ - { - "line": "#0 0xaf036287 in strlen", - "address": 2936234631, - "module_path": "strlen" - } - ] -} diff --git a/src/agent/libclusterfuzz/data/parsed-traces/address_in_state.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@address_in_state.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/address_in_state.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@address_in_state.txt.snap index 407ef9f2b3..f985f41cd8 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/address_in_state.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@address_in_state.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/address_in_state.txt +--- { "text": "[0623/024556:ERROR:gl_surface_egl.cc(486)] eglInitialize D3D11 failed with error UNKNOWN, trying next display type\n[0623/024556:ERROR:gl_surface_egl.cc(486)] eglInitialize D3D9 failed with error UNKNOWN\n[0623/024557:ERROR:gl_surface_egl.cc(486)] eglInitialize D3D11 failed with error UNKNOWN, trying next display type\n[0623/024557:ERROR:gl_surface_egl.cc(486)] eglInitialize D3D9 failed with error UNKNOWN\n[0623/024557:ERROR:gl_surface_win.cc(170)] GLSurfaceEGL::InitializeOneOff failed.\n=================================================================\n==6512==ERROR: AddressSanitizer: access-violation on unknown address 0x00000000 (pc 0x10c2323d bp 0x0045c518 sp 0x0045c514 T0)\n #0 0x10c2323c in GetHandleVerifier+0x15a519c (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x1a9323c)\n #1 0x10c18f60 in GetHandleVerifier+0x159aec0 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x1a88f60)\n #2 0x10c1b301 in GetHandleVerifier+0x159d261 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x1a8b301)\n #3 0x12055649 in ovly_debug_event+0xf8af79 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x2ec5649)\n #4 0x1204f3ec in ovly_debug_event+0xf84d1c (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x2ebf3ec)\n #5 0x1204f112 in ovly_debug_event+0xf84a42 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x2ebf112)\n #6 0x11db641c in ovly_debug_event+0xcebd4c (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x2c2641c)\n #7 0x136db8d4 in ovly_debug_event+0x2611204 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x454b8d4)\n #8 0x13700464 in ovly_debug_event+0x2635d94 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x4570464)\n #9 0x136fb7dd in ovly_debug_event+0x263110d (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x456b7dd)\n #10 0x13700fce in ovly_debug_event+0x26368fe (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x4570fce)\n #11 0x13d35a97 in ovly_debug_event+0x2c6b3c7 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x4ba5a97)\n #12 0x13dc9bc7 in ovly_debug_event+0x2cff4f7 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x4c39bc7)\n #13 0x1b6199f1 in IsSandboxedProcess+0x3a2c811 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0xc4899f1)\n #14 0x16284d8f in ovly_debug_event+0x51ba6bf (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x70f4d8f)\n #15 0x16280836 in ovly_debug_event+0x51b6166 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x70f0836)\n #16 0x1627e4e7 in ovly_debug_event+0x51b3e17 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x70ee4e7)\n #17 0xf420e40 in ChromeMain+0x28fe40 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x290e40)\n #18 0x1b5d11ca in IsSandboxedProcess+0x39e3fea (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0xc4411ca)\n #19 0xf753b60 in GetHandleVerifier+0xd5ac0 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x5c3b60)\n #20 0x1b74cbd4 in IsSandboxedProcess+0x3b5f9f4 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0xc5bcbd4)\n #21 0x1b74b0da in IsSandboxedProcess+0x3b5defa (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0xc5bb0da)\n #22 0x1b74e3b0 in IsSandboxedProcess+0x3b611d0 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0xc5be3b0)\n #23 0xf753b60 in GetHandleVerifier+0xd5ac0 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x5c3b60)\n #24 0xf6776a9 in ChromeMain+0x4e66a9 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x4e76a9)\n #25 0xf678c20 in ChromeMain+0x4e7c20 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x4e8c20)\n #26 0xf756097 in GetHandleVerifier+0xd7ff7 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x5c6097)\n #27 0xf6764e6 in ChromeMain+0x4e54e6 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x4e64e6)\n #28 0xf75678f in GetHandleVerifier+0xd86ef (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x5c678f)\n #29 0xf675948 in ChromeMain+0x4e4948 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x4e5948)\n #30 0x16573897 in ovly_debug_event+0x54a91c7 (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x73e3897)\n #31 0xf57505f in ChromeMain+0x3e405f (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x3e505f)\n #32 0xf576e4c in ChromeMain+0x3e5e4c (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x3e6e4c)\n #33 0xf574c1b in ChromeMain+0x3e3c1b (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x3e4c1b)\n #34 0xf19113f in ChromeMain+0x13f (C:\\clusterfuzz\\bot\\builds\\chrome-test-builds_media_win32-release\\revisions\\asan-win32-release-335593\\chrome_child.dll+0x113f)\n #35 0x11d976c in MainDllLoader::Launch chrome/app/client_util.cc:252\n #36 0x11d310d in main chrome/app/chrome_exe_main_win.cc:157\n #37 0x1384f0a in __tmainCRTStartup f:\\dd\\vctools\\crt\\crtw32\\startup\\crt0.c:255\n #38 0x76a23379 in BaseThreadInitThunk+0x11 (C:\\Windows\\syswow64\\kernel32.dll+0x13379)\n #39 0x77a692b1 in RtlInitializeExceptionChain+0x62 (C:\\Windows\\SysWOW64\\ntdll.dll+0x392b1)\n #40 0x77a69284 in RtlInitializeExceptionChain+0x35 (C:\\Windows\\SysWOW64\\ntdll.dll+0x39284)", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/android_asan_null_dereference_read.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@android_asan_null_dereference_read.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/android_asan_null_dereference_read.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@android_asan_null_dereference_read.txt.snap index 822e7d01dc..3c389331c2 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/android_asan_null_dereference_read.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@android_asan_null_dereference_read.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/android_asan_null_dereference_read.txt +--- { "text": "==13931==ERROR: AddressSanitizer: SEGV on unknown address 0x00000011 (pc 0xb2011bf5 bp 0xaee0e750 sp 0xaebff7b0 T8)\n==13931==The signal is caused by a READ memory access.\n==13931==Hint: address points to the zero page.\n#0 0xb2011bf4 in _JavaVM::AttachCurrentThread(_JNIEnv**, void*) libnativehelper/include/nativehelper/jni.h:1060\n#1 0xb2011bf4 in javaAttachThread frameworks/base/core/jni/AndroidRuntime.cpp:1131\n#2 0xb2011bf4 in android::AndroidRuntime::javaThreadShell(void*) frameworks/base/core/jni/AndroidRuntime.cpp:1169\n#3 0xb1e188a9 in thread_data_t::trampoline(thread_data_t const*) system/core/libutils/Threads.cpp:99:16\n#4 0xb2370d0c in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*)\n#5 0xb23550f9 in asan_thread_start(void*)\n#6 0xb1ec8404 in __pthread_start(void*) bionic/libc/bionic/pthread_create.cpp:198:18\n#7 0xb1e73610 in __start_thread bionic/libc/bionic/clone.cpp:41:16\n#8 0xb1e713c6 in __bionic_clone bionic/libc/arch-x86/bionic/__bionic_clone.S:54\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/system/lib/libandroid_runtime.so+0x71bf4)\nThread T8 (Binder:13931_2) created by T7 (Binder:13931_1) here:\n#0 0xb2354f89 in pthread_create\n#1 0xb1e18714 in androidCreateRawThreadEtc system/core/libutils/Threads.cpp:160:18\n#2 0xb2011cfd in android::AndroidRuntime::javaCreateThreadEtc(int (*)(void*), void*, char const*, int, unsigned int, void**) frameworks/base/core/jni/AndroidRuntime.cpp:1207\n#3 0xb183b361 in android::ProcessState::spawnPooledThread(bool) frameworks/native/libs/binder/ProcessState.cpp:293:9\n#4 0xb1814fc9 in android::IPCThreadState::executeCommand(int) frameworks/native/libs/binder/IPCThreadState.cpp:1169:9\n#5 0xb1814a7e in android::IPCThreadState::getAndExecuteCommand() frameworks/native/libs/binder/IPCThreadState.cpp:445:18\n#6 0xb18152bf in android::IPCThreadState::joinThreadPool(bool) frameworks/native/libs/binder/IPCThreadState.cpp:513:18\n#7 0xb183c12e in android::PoolThread::threadLoop() frameworks/native/libs/binder/ProcessState.cpp:63:9\n#8 0xb1e190d9 in android::Thread::_threadLoop(void*) system/core/libutils/Threads.cpp:751:26\n#9 0xb2011c00 in android::AndroidRuntime::javaThreadShell(void*) frameworks/base/core/jni/AndroidRuntime.cpp:1173\nThread T7 (Binder:13931_1) created by T0 (Shutdown thread) here:\n#0 0xb2354f89 in pthread_create\n#1 0xb1e18714 in androidCreateRawThreadEtc system/core/libutils/Threads.cpp:160:18\n#2 0xb2011cfd in android::AndroidRuntime::javaCreateThreadEtc(int (*)(void*), void*, char const*, int, unsigned int, void**) frameworks/base/core/jni/AndroidRuntime.cpp:1207\n#3 0xb183b361 in android::ProcessState::spawnPooledThread(bool) frameworks/native/libs/binder/ProcessState.cpp:293:9\n#4 0xb183b253 in android::ProcessState::startThreadPool() frameworks/native/libs/binder/ProcessState.cpp:137:9\n#5 0xb5611f7f in android::AppRuntime::onStarted() frameworks/base/cmds/app_process/app_main.cpp:83:9\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/android_asan_null_dereference_write.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@android_asan_null_dereference_write.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/android_asan_null_dereference_write.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@android_asan_null_dereference_write.txt.snap index 47f88bd6df..784486f39d 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/android_asan_null_dereference_write.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@android_asan_null_dereference_write.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/android_asan_null_dereference_write.txt +--- { "text": "==13931==ERROR: AddressSanitizer: SEGV on unknown address 0x00000011 (pc 0xb2011bf5 bp 0xaee0e750 sp 0xaebff7b0 T8)\n==13931==The signal is caused by a WRITE memory access.\n==13931==Hint: address points to the zero page.\n#0 0xb2011bf4 in _JavaVM::AttachCurrentThread(_JNIEnv**, void*) libnativehelper/include/nativehelper/jni.h:1060\n#1 0xb2011bf4 in javaAttachThread frameworks/base/core/jni/AndroidRuntime.cpp:1131\n#2 0xb2011bf4 in android::AndroidRuntime::javaThreadShell(void*) frameworks/base/core/jni/AndroidRuntime.cpp:1169\n#3 0xb1e188a9 in thread_data_t::trampoline(thread_data_t const*) system/core/libutils/Threads.cpp:99:16\n#4 0xb2370d0c in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*)\n#5 0xb23550f9 in asan_thread_start(void*)\n#6 0xb1ec8404 in __pthread_start(void*) bionic/libc/bionic/pthread_create.cpp:198:18\n#7 0xb1e73610 in __start_thread bionic/libc/bionic/clone.cpp:41:16\n#8 0xb1e713c6 in __bionic_clone bionic/libc/arch-x86/bionic/__bionic_clone.S:54\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/system/lib/libandroid_runtime.so+0x71bf4)\nThread T8 (Binder:13931_2) created by T7 (Binder:13931_1) here:\n#0 0xb2354f89 in pthread_create\n#1 0xb1e18714 in androidCreateRawThreadEtc system/core/libutils/Threads.cpp:160:18\n#2 0xb2011cfd in android::AndroidRuntime::javaCreateThreadEtc(int (*)(void*), void*, char const*, int, unsigned int, void**) frameworks/base/core/jni/AndroidRuntime.cpp:1207\n#3 0xb183b361 in android::ProcessState::spawnPooledThread(bool) frameworks/native/libs/binder/ProcessState.cpp:293:9\n#4 0xb1814fc9 in android::IPCThreadState::executeCommand(int) frameworks/native/libs/binder/IPCThreadState.cpp:1169:9\n#5 0xb1814a7e in android::IPCThreadState::getAndExecuteCommand() frameworks/native/libs/binder/IPCThreadState.cpp:445:18\n#6 0xb18152bf in android::IPCThreadState::joinThreadPool(bool) frameworks/native/libs/binder/IPCThreadState.cpp:513:18\n#7 0xb183c12e in android::PoolThread::threadLoop() frameworks/native/libs/binder/ProcessState.cpp:63:9\n#8 0xb1e190d9 in android::Thread::_threadLoop(void*) system/core/libutils/Threads.cpp:751:26\n#9 0xb2011c00 in android::AndroidRuntime::javaThreadShell(void*) frameworks/base/core/jni/AndroidRuntime.cpp:1173\nThread T7 (Binder:13931_1) created by T0 (Shutdown thread) here:\n#0 0xb2354f89 in pthread_create\n#1 0xb1e18714 in androidCreateRawThreadEtc system/core/libutils/Threads.cpp:160:18\n#2 0xb2011cfd in android::AndroidRuntime::javaCreateThreadEtc(int (*)(void*), void*, char const*, int, unsigned int, void**) frameworks/base/core/jni/AndroidRuntime.cpp:1207\n#3 0xb183b361 in android::ProcessState::spawnPooledThread(bool) frameworks/native/libs/binder/ProcessState.cpp:293:9\n#4 0xb183b253 in android::ProcessState::startThreadPool() frameworks/native/libs/binder/ProcessState.cpp:137:9\n#5 0xb5611f7f in android::AppRuntime::onStarted() frameworks/base/cmds/app_process/app_main.cpp:83:9\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/android_asan_unknown_read.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@android_asan_unknown_read.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/android_asan_unknown_read.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@android_asan_unknown_read.txt.snap index 652a5222fd..5b007db1f2 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/android_asan_unknown_read.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@android_asan_unknown_read.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/android_asan_unknown_read.txt +--- { "text": "==20085==ERROR: AddressSanitizer: SEGV on unknown address 0x74000011 (pc 0xa843fbf5 bp 0xa620e750 sp 0xa5dff7b0 T8)\n==20085==The signal is caused by a READ memory access.\n #0 0xa843fbf4 in _JavaVM::AttachCurrentThread(_JNIEnv**, void*) libnativehelper/include/nativehelper/jni.h:1060\n #1 0xa843fbf4 in javaAttachThread frameworks/base/core/jni/AndroidRuntime.cpp:1131\n #2 0xa843fbf4 in android::AndroidRuntime::javaThreadShell(void*) frameworks/base/core/jni/AndroidRuntime.cpp:1169\n #3 0xa83bc8a9 in thread_data_t::trampoline(thread_data_t const*) system/core/libutils/Threads.cpp:99:16\n #4 0xa899bd0c in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*)\n #5 0xa89800f9 in asan_thread_start(void*)\n #6 0xa9a7f404 in __pthread_start(void*) bionic/libc/bionic/pthread_create.cpp:198:18\n #7 0xa9a2a610 in __start_thread bionic/libc/bionic/clone.cpp:41:16\n #8 0xa9a283c6 in __bionic_clone bionic/libc/arch-x86/bionic/__bionic_clone.S:54\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/system/lib/libandroid_runtime.so+0x71bf4)\nThread T8 (Binder:20085_2) created by T7 (Binder:20085_1) here:\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/android_asan_unknown_write.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@android_asan_unknown_write.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/android_asan_unknown_write.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@android_asan_unknown_write.txt.snap index 33dc8371ed..ac6e27f40c 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/android_asan_unknown_write.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@android_asan_unknown_write.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/android_asan_unknown_write.txt +--- { "text": "==20085==ERROR: AddressSanitizer: SEGV on unknown address 0x74000011 (pc 0xa843fbf5 bp 0xa620e750 sp 0xa5dff7b0 T8)\n==20085==The signal is caused by a WRITE memory access.\n #0 0xa843fbf4 in _JavaVM::AttachCurrentThread(_JNIEnv**, void*) libnativehelper/include/nativehelper/jni.h:1060\n #1 0xa843fbf4 in javaAttachThread frameworks/base/core/jni/AndroidRuntime.cpp:1131\n #2 0xa843fbf4 in android::AndroidRuntime::javaThreadShell(void*) frameworks/base/core/jni/AndroidRuntime.cpp:1169\n #3 0xa83bc8a9 in thread_data_t::trampoline(thread_data_t const*) system/core/libutils/Threads.cpp:99:16\n #4 0xa899bd0c in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*)\n #5 0xa89800f9 in asan_thread_start(void*)\n #6 0xa9a7f404 in __pthread_start(void*) bionic/libc/bionic/pthread_create.cpp:198:18\n #7 0xa9a2a610 in __start_thread bionic/libc/bionic/clone.cpp:41:16\n #8 0xa9a283c6 in __bionic_clone bionic/libc/arch-x86/bionic/__bionic_clone.S:54\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/system/lib/libandroid_runtime.so+0x71bf4)\nThread T8 (Binder:20085_2) created by T7 (Binder:20085_1) here:\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_assert_failure.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_assert_failure.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_assert_failure.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_assert_failure.txt.snap index 1f62a2d5eb..8614a756a4 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_assert_failure.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_assert_failure.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_assert_failure.txt +--- { "text": "[2018-05-17 07:01:35.491][1][info][main] source/server/server.cc:203] transport_sockets.upstream: envoy.transport_sockets.capture,raw_buffer,ssl\n[2018-05-17 07:01:35.506][1][critical][assert] source/common/network/address_impl.cc:87] assert failure: ss_len == 0 || ss_len >= offsetof(struct sockaddr_un, sun_path) + 1\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7f7fc7ff6428 bp 0x7ffe6ecd35f0 sp 0x7ffe6ecd32a8 T0)\nSCARINESS: 10 (signal)\n#0 0x7f7fc7ff6427 in gsignal /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54\n#1 0x7f7fc7ff8029 in abort /build/glibc-Cl5G7W/glibc-2.23/stdlib/abort.c:89\n#2 0x1fefa77 in Envoy::Network::Address::addressFromSockAddr(sockaddr_storage const&, unsigned int, bool) /proc/self/cwd/source/common/network/address_impl.cc:87:5\n#3 0x1fefe18 in Envoy::Network::Address::addressFromFd(int) /proc/self/cwd/source/common/network/address_impl.cc:109:10\n#4 0x11fcb3c in Envoy::Network::AddrFailyAwareSocketOptionImpl::setIpSocketOption(Envoy::Network::Socket&, Envoy::Network::Socket::SocketState, std::__1::unique_ptr > const&, std::__1::unique_ptr > const&) /proc/self/cwd/source/common/network/addr_family_aware_socket_option_impl.cc:31:17\n#5 0x6f1410 in Envoy::Network::Socket::applyOptions(std::__1::shared_ptr, std::__1::allocator > > > const&, Envoy::Network::Socket&, Envoy::Network::Socket::SocketState) /proc/self/cwd/bazel-out/k8-fastbuild/bin/include/envoy/network/_virtual_includes/listen_socket_interface/envoy/network/listen_socket.h:81:20\n#6 0x74b155 in Envoy::Network::ClientConnectionImpl::ClientConnectionImpl(Envoy::Event::Dispatcher&, std::__1::shared_ptr const&, std::__1::shared_ptr const&, std::__1::unique_ptr >&&, std::__1::shared_ptr, std::__1::allocator > > > const&) /proc/self/cwd/source/common/network/connection_impl.cc:538:8\n#7 0x736312 in make_unique &, std::__1::shared_ptr &, std::__1::unique_ptr >, const std::__1::shared_ptr, std::__1::allocator > > > &> /usr/local/include/c++/v1/memory:3114:32\n#8 0x736312 in Envoy::Event::DispatcherImpl::createClientConnection(std::__1::shared_ptr, std::__1::shared_ptr, std::__1::unique_ptr >&&, std::__1::shared_ptr, std::__1::allocator > > > const&) /proc/self/cwd/source/common/event/dispatcher_impl.cc:89\n#9 0x1139ad9 in Envoy::Upstream::HostImpl::createConnection(Envoy::Event::Dispatcher&, Envoy::Upstream::ClusterInfo const&, std::__1::shared_ptr, std::__1::shared_ptr, std::__1::allocator > > > const&) /proc/self/cwd/source/common/upstream/upstream_impl.cc:134:56\n#10 0x113a2a7 in Envoy::Upstream::HostImpl::createHealthCheckConnection(Envoy::Event::Dispatcher&) const /proc/self/cwd/source/common/upstream/upstream_impl.cc:112:11\n#11 0x113a5af in non-virtual thunk to Envoy::Upstream::HostImpl::createHealthCheckConnection(Envoy::Event::Dispatcher&) const /proc/self/cwd/source/common/upstream/upstream_impl.cc:0\n#12 0x11922df in Envoy::Upstream::TcpHealthCheckerImpl::TcpActiveHealthCheckSession::onInterval() /proc/self/cwd/source/common/upstream/health_checker_impl.cc:304:22\n#13 0x12e3a38 in Envoy::Upstream::HealthCheckerImplBase::ActiveHealthCheckSession::onIntervalBase() /proc/self/cwd/source/common/upstream/health_checker_base_impl.cc:250:3\n#14 0x12e0c79 in Envoy::Upstream::HealthCheckerImplBase::addHosts(std::__1::vector, std::__1::allocator > > const&) /proc/self/cwd/source/common/upstream/health_checker_base_impl.cc:103:29\n#15 0x12e0fbf in Envoy::Upstream::HealthCheckerImplBase::onClusterMemberUpdate(std::__1::vector, std::__1::allocator > > const&, std::__1::vector, std::__1::allocator > > const&) /proc/self/cwd/source/common/upstream/health_checker_base_impl.cc:109:3\n#16 0x7a4db2 in std::__1::function, std::__1::allocator > > const&, std::__1::vector, std::__1::allocator > > const&)>::operator()(unsigned int, std::__1::vector, std::__1::allocator > > const&, std::__1::vector, std::__1::allocator > > const&) const /usr/local/include/c++/v1/functional:1913:12\n#17 0x7a4c22 in Envoy::Common::CallbackManager, std::__1::allocator > > const&, std::__1::vector, std::__1::allocator > > const&>::runCallbacks(unsigned int, std::__1::vector, std::__1::allocator > > const&, std::__1::vector, std::__1::allocator > > const&) /proc/self/cwd/bazel-out/k8-fastbuild/bin/source/common/common/_virtual_includes/callback_impl_lib/common/common/callback_impl.h:40:7\n#18 0x7a4db2 in std::__1::function, std::__1::allocator > > const&, std::__1::vector, std::__1::allocator > > const&)>::operator()(unsigned int, std::__1::vector, std::__1::allocator > > const&, std::__1::vector, std::__1::allocator > > const&) const /usr/local/include/c++/v1/functional:1913:12\n#19 0x7a4c22 in Envoy::Common::CallbackManager, std::__1::allocator > > const&, std::__1::vector, std::__1::allocator > > const&>::runCallbacks(unsigned int, std::__1::vector, std::__1::allocator > > const&, std::__1::vector, std::__1::allocator > > const&) /proc/self/cwd/bazel-out/k8-fastbuild/bin/source/common/common/_virtual_includes/callback_impl_lib/common/common/callback_impl.h:40:7\n#20 0x113bc59 in Envoy::Upstream::HostSetImpl::updateHosts(std::__1::shared_ptr, std::__1::allocator > > const>, std::__1::shared_ptr, std::__1::allocator > > const>, std::__1::shared_ptr, std::__1::shared_ptr, std::__1::shared_ptr > const>, std::__1::vector, std::__1::allocator > > const&, std::__1::vector, std::__1::allocator > > const&) /proc/self/cwd/source/common/upstream/upstream_impl.cc:193:3\n#21 0x114de37 in Envoy::Upstream::StaticClusterImpl::startPreInit() /proc/self/cwd/source/common/upstream/upstream_impl.cc:652:18\n#22 0x78153f in Envoy::Upstream::ClusterManagerInitHelper::addCluster(Envoy::Upstream::Cluster&) /proc/self/cwd/source/common/upstream/cluster_manager_impl.cc:48:13\n#23 0x784458 in Envoy::Upstream::ClusterManagerImpl::ClusterManagerImpl(envoy::config::bootstrap::v2::Bootstrap const&, Envoy::Upstream::ClusterManagerFactory&, Envoy::Stats::Store&, Envoy::ThreadLocal::Instance&, Envoy::Runtime::Loader&, Envoy::Runtime::RandomGenerator&, Envoy::LocalInfo::LocalInfo const&, Envoy::AccessLog::AccessLogManager&, Envoy::Event::Dispatcher&, Envoy::Server::Admin&) /proc/self/cwd/source/common/upstream/cluster_manager_impl.cc:287:18\n#24 0x793919 in Envoy::Upstream::ProdClusterManagerFactory::clusterManagerFromProto(envoy::config::bootstrap::v2::Bootstrap const&, Envoy::Stats::Store&, Envoy::ThreadLocal::Instance&, Envoy::Runtime::Loader&, Envoy::Runtime::RandomGenerator&, Envoy::LocalInfo::LocalInfo const&, Envoy::AccessLog::AccessLogManager&, Envoy::Server::Admin&) /proc/self/cwd/source/common/upstream/cluster_manager_impl.cc:941:32\n#25 0x1982c9f in Envoy::Server::Configuration::MainImpl::initialize(envoy::config::bootstrap::v2::Bootstrap const&, Envoy::Server::Instance&, Envoy::Upstream::ClusterManagerFactory&) /proc/self/cwd/source/server/configuration_impl.cc:49:46\n#26 0x6c218f in Envoy::Server::InstanceImpl::initialize(Envoy::Server::Options&, std::__1::shared_ptr, Envoy::Server::ComponentFactory&) /proc/self/cwd/source/server/server.cc:272:16\n#27 0x6be506 in Envoy::Server::InstanceImpl::InstanceImpl(Envoy::Server::Options&, std::__1::shared_ptr, Envoy::TestHooks&, Envoy::Server::HotRestart&, Envoy::Stats::StoreRoot&, Envoy::Thread::BasicLockable&, Envoy::Server::ComponentFactory&, std::__1::unique_ptr >&&, Envoy::ThreadLocal::Instance&) /proc/self/cwd/source/server/server.cc:73:5\n#28 0x5fa709 in make_unique &, std::__1::shared_ptr, Envoy::DefaultTestHooks &, testing::NiceMock &, Envoy::Stats::TestIsolatedStoreImpl &, Envoy::Thread::MutexBasicLockable &, Envoy::Server::TestComponentFactory &, std::__1::unique_ptr >, Envoy::ThreadLocal::InstanceImpl &> /usr/local/include/c++/v1/memory:3114:32\n#29 0x5fa709 in Envoy::Server::TestOneProtoInput(envoy::config::bootstrap::v2::Bootstrap const&) /proc/self/cwd/test/server/server_fuzz_test.cc:36\n#30 0x5f9e5d in LLVMFuzzerTestOneInput /proc/self/cwd/test/server/server_fuzz_test.cc:18:1\n#31 0x258ef6c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:524:13\n#32 0x256deba in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6\n#33 0x2579268 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:705:9\n#34 0x256d55c in main /src/libfuzzer/FuzzerMain.cpp:20:10\n#35 0x7f7fc7fe182f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291\n#36 0x4e9428 in _start\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x35427)\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_breakpoint.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_breakpoint.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_breakpoint.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_breakpoint.txt.snap index e82da4ba4d..03ae14fbb8 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_breakpoint.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_breakpoint.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_breakpoint.txt +--- { "text": "=================================================================\n==2304==ERROR: AddressSanitizer: breakpoint on unknown address 0xba0f4780 (pc 0x13458f6c bp 0x0067b158 sp 0x0067b158 T0)\n==2304==The signal is caused by a READ memory access.\nSCARINESS: 20 (wild-addr-read)\n==2304==*** WARNING: Failed to initialize DbgHelp! ***\n==2304==*** Most likely this means that the app is already ***\n==2304==*** using DbgHelp, possibly with incompatible flags. ***\n==2304==*** Due to technical reasons, symbolization might crash ***\n==2304==*** or produce wrong results. ***\n==2304==WARNING: Failed to use and restart external symbolizer!\n #0 0x13458f6b in base::debug::BreakDebugger C:\\b\\c\\b\\win_asan_release_media\\src\\base\\debug\\debugger_win.cc:18\n #1 0x1321cea6 in logging::LogMessage::~LogMessage C:\\b\\c\\b\\win_asan_release_media\\src\\base\\logging.cc:783\n #2 0x1b23f3a8 in WTF::Vector,0,blink::HeapAllocator>::at C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\platform\\wtf\\Vector.h:1007\n #3 0x1b23cd90 in blink::PluginInfo::GetMimeClassInfo C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\platform\\plugins\\PluginData.cpp:56\n #4 0x1d60fc91 in blink::DOMPlugin::item C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\modules\\plugins\\DOMPlugin.cpp:54\n #5 0x1d8cd8db in blink::V8Plugin::itemMethodCallback C:\\b\\c\\b\\win_asan_release_media\\src\\out\\release\\gen\\blink\\bindings\\modules\\v8\\V8Plugin.cpp:177\n #6 0x10bd3915 in v8::internal::FunctionCallbackArguments::Call C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\api-arguments.cc:25\n #7 0x10e22d04 in v8::internal::`anonymous namespace'::HandleApiCallHelper<0> C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\builtins\\builtins-api.cc:112\n #8 0x10e1fa41 in v8::internal::Builtin_Impl_HandleApiCall C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\builtins\\builtins-api.cc:142\n #9 0x10e1eea1 in v8::internal::Builtin_HandleApiCall C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\builtins\\builtins-api.cc:130\n #10 0x2c6063fd ()\n #11 0x255bc0a5 ()\n #12 0x2558e7f3 ()\n #13 0x2c6074b5 ()\n #14 0xeb4355a ()\n #15 0xeb43ae9 ()\n #16 0xeb43d5b ()\n #17 0xeb43d5b ()\n #18 0x255bc52d ()\n #19 0x2558e7f3 ()\n #20 0x255bc97c ()\n #21 0x2558e7f3 ()\n #22 0x2558d83d ()\n #23 0x2c606097 ()\n #24 0x1190df62 in v8::internal::`anonymous namespace'::Invoke C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\execution.cc:145\n #25 0x1190d6fa in v8::internal::Execution::Call C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\execution.cc:190\n #26 0x10bfc31b in v8::Script::Run C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\api.cc:2060\n #27 0x1a931a24 in blink::V8ScriptRunner::RunCompiledScript C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\bindings\\core\\v8\\V8ScriptRunner.cpp:573\n #28 0x1a8c4240 in blink::ScriptController::ExecuteScriptAndReturnValue C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\bindings\\core\\v8\\ScriptController.cpp:135\n #29 0x1cbd8c39 in blink::ScheduledAction::Execute C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\bindings\\core\\v8\\ScheduledAction.cpp:161\n #30 0x1cbd83af in blink::ScheduledAction::Execute C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\bindings\\core\\v8\\ScheduledAction.cpp:107\n #31 0x1bca2c17 in blink::DOMTimer::Fired C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\core\\frame\\DOMTimer.cpp:172\n #32 0x16b923b8 in blink::TimerBase::RunInternal C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\platform\\Timer.cpp:174\n #33 0x134b4656 in base::debug::TaskAnnotator::RunTask C:\\b\\c\\b\\win_asan_release_media\\src\\base\\debug\\task_annotator.cc:57\n #34 0x16d84b2d in blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\platform\\scheduler\\base\\task_queue_manager.cc:531\n #35 0x16d7fc8d in blink::scheduler::TaskQueueManager::DoWork C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\platform\\scheduler\\base\\task_queue_manager.cc:329\n #36 0x15386db0 in base::internal::Invoker,bool>,void ()>::Run C:\\b\\c\\b\\win_asan_release_media\\src\\base\\bind_internal.h:330\n #37 0x102b5c1b in base::CancelableCallback::Forward C:\\b\\c\\b\\win_asan_release_media\\src\\base\\cancelable_callback.h:109\n #38 0x134b4656 in base::debug::TaskAnnotator::RunTask C:\\b\\c\\b\\win_asan_release_media\\src\\base\\debug\\task_annotator.cc:57\n #39 0x13357e00 in base::MessageLoop::RunTask C:\\b\\c\\b\\win_asan_release_media\\src\\base\\message_loop\\message_loop.cc:422\n #40 0x13358e0b in base::MessageLoop::DeferOrRunPendingTask C:\\b\\c\\b\\win_asan_release_media\\src\\base\\message_loop\\message_loop.cc:433\n #41 0x1335a2df in base::MessageLoop::DoDelayedWork C:\\b\\c\\b\\win_asan_release_media\\src\\base\\message_loop\\message_loop.cc:580\n #42 0x134baf0f in base::MessagePumpDefault::Run C:\\b\\c\\b\\win_asan_release_media\\src\\base\\message_loop\\message_pump_default.cc:37\n #43 0x13356e04 in base::MessageLoop::Run C:\\b\\c\\b\\win_asan_release_media\\src\\base\\message_loop\\message_loop.cc:369\n #44 0x133f2fcb in base::RunLoop::Run C:\\b\\c\\b\\win_asan_release_media\\src\\base\\run_loop.cc:111\n #45 0x181e421f in content::RendererMain C:\\b\\c\\b\\win_asan_release_media\\src\\content\\renderer\\renderer_main.cc:219\n #46 0x132044f8 in content::RunNamedProcessTypeMain C:\\b\\c\\b\\win_asan_release_media\\src\\content\\app\\content_main_runner.cc:411\n #47 0x13205ab7 in content::ContentMainRunnerImpl::Run C:\\b\\c\\b\\win_asan_release_media\\src\\content\\app\\content_main_runner.cc:704\n #48 0x1321722d in service_manager::Main C:\\b\\c\\b\\win_asan_release_media\\src\\services\\service_manager\\embedder\\main.cc:469\n #49 0x132041dc in content::ContentMain C:\\b\\c\\b\\win_asan_release_media\\src\\content\\app\\content_main.cc:19\n #50 0xfe91262 in ChromeMain C:\\b\\c\\b\\win_asan_release_media\\src\\chrome\\app\\chrome_main.cc:119\n #51 0x13584a6 in MainDllLoader::Launch C:\\b\\c\\b\\win_asan_release_media\\src\\chrome\\app\\main_dll_loader_win.cc:199\n #52 0x1351ccb in main C:\\b\\c\\b\\win_asan_release_media\\src\\chrome\\app\\chrome_exe_main_win.cc:268\n #53 0x16c5a59 in __scrt_common_main_seh f:\\dd\\vctools\\crt\\vcstartup\\src\\startup\\exe_common.inl:283\n #54 0x77487c03 in BaseThreadInitThunk+0x23 (C:\\windows\\SYSTEM32\\KERNEL32.DLL+0x17c03)\n #55 0x77a9ad2e in RtlInitializeExceptionChain+0x8e (C:\\windows\\SYSTEM32\\ntdll.dll+0x5ad2e)\n #56 0x77a9acf9 in RtlInitializeExceptionChain+0x59 (C:\\windows\\SYSTEM32\\ntdll.dll+0x5acf9)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: breakpoint C:\\b\\c\\b\\win_asan_release_media\\src\\base\\debug\\debugger_win.cc:18 in base::debug::BreakDebugger\n==2304==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_breakpoint_with_check.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_breakpoint_with_check.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_breakpoint_with_check.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_breakpoint_with_check.txt.snap index ab81d643ed..50ee6fbd77 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_breakpoint_with_check.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_breakpoint_with_check.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_breakpoint_with_check.txt +--- { "text": "[0617/152313.001:FATAL:Vector.h(1007)] Check failed: i < size() (1 vs. 1)\nBacktrace:\n\tbase::debug::StackTrace::StackTrace [0x13454F91+33] (C:\\b\\c\\b\\win_asan_release_media\\src\\base\\debug\\stack_trace_win.cc:217)\n\tbase::debug::StackTrace::StackTrace [0x13458F8D+13] (C:\\b\\c\\b\\win_asan_release_media\\src\\base\\debug\\stack_trace.cc:199)\n\tlogging::LogMessage::~LogMessage [0x1321C3FE+574] (C:\\b\\c\\b\\win_asan_release_media\\src\\base\\logging.cc:552)\n\tWTF::Vector,0,blink::HeapAllocator>::at [0x1B23F3A9+367] (C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\platform\\wtf\\Vector.h:1007)\n\tblink::PluginInfo::GetMimeClassInfo [0x1B23CD91+41] (C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\platform\\plugins\\PluginData.cpp:56)\n\tblink::DOMPlugin::item [0x1D60FC92+36] (C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\modules\\plugins\\DOMPlugin.cpp:54)\n\tblink::V8Plugin::itemMethodCallback [0x1D8CD8DC+1012] (C:\\b\\c\\b\\win_asan_release_media\\src\\out\\release\\gen\\blink\\bindings\\modules\\v8\\V8Plugin.cpp:177)\n\tv8::internal::FunctionCallbackArguments::Call [0x10BD3916+1286] (C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\api-arguments.cc:25)\n\tv8::internal::`anonymous namespace'::HandleApiCallHelper<0> [0x10E22D05+3109] (C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\builtins\\builtins-api.cc:112)\n\tv8::internal::Builtin_Impl_HandleApiCall [0x10E1FA42+674] (C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\builtins\\builtins-api.cc:142)\n\tv8::internal::Builtin_HandleApiCall [0x10E1EEA2+50] (C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\builtins\\builtins-api.cc:130)\n\n=================================================================\n==2304==ERROR: AddressSanitizer: breakpoint on unknown address 0xba0f4780 (pc 0x13458f6c bp 0x0067b158 sp 0x0067b158 T0)\n==2304==The signal is caused by a READ memory access.\nSCARINESS: 20 (wild-addr-read)\n==2304==*** WARNING: Failed to initialize DbgHelp! ***\n==2304==*** Most likely this means that the app is already ***\n==2304==*** using DbgHelp, possibly with incompatible flags. ***\n==2304==*** Due to technical reasons, symbolization might crash ***\n==2304==*** or produce wrong results. ***\n==2304==WARNING: Failed to use and restart external symbolizer!\n #0 0x13458f6b in base::debug::BreakDebugger C:\\b\\c\\b\\win_asan_release_media\\src\\base\\debug\\debugger_win.cc:18\n #1 0x1321cea6 in logging::LogMessage::~LogMessage C:\\b\\c\\b\\win_asan_release_media\\src\\base\\logging.cc:783\n #2 0x1b23f3a8 in WTF::Vector,0,blink::HeapAllocator>::at C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\platform\\wtf\\Vector.h:1007\n #3 0x1b23cd90 in blink::PluginInfo::GetMimeClassInfo C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\platform\\plugins\\PluginData.cpp:56\n #4 0x1d60fc91 in blink::DOMPlugin::item C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\modules\\plugins\\DOMPlugin.cpp:54\n #5 0x1d8cd8db in blink::V8Plugin::itemMethodCallback C:\\b\\c\\b\\win_asan_release_media\\src\\out\\release\\gen\\blink\\bindings\\modules\\v8\\V8Plugin.cpp:177\n #6 0x10bd3915 in v8::internal::FunctionCallbackArguments::Call C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\api-arguments.cc:25\n #7 0x10e22d04 in v8::internal::`anonymous namespace'::HandleApiCallHelper<0> C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\builtins\\builtins-api.cc:112\n #8 0x10e1fa41 in v8::internal::Builtin_Impl_HandleApiCall C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\builtins\\builtins-api.cc:142\n #9 0x10e1eea1 in v8::internal::Builtin_HandleApiCall C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\builtins\\builtins-api.cc:130\n #10 0x2c6063fd ()\n #11 0x255bc0a5 ()\n #12 0x2558e7f3 ()\n #13 0x2c6074b5 ()\n #14 0xeb4355a ()\n #15 0xeb43ae9 ()\n #16 0xeb43d5b ()\n #17 0xeb43d5b ()\n #18 0x255bc52d ()\n #19 0x2558e7f3 ()\n #20 0x255bc97c ()\n #21 0x2558e7f3 ()\n #22 0x2558d83d ()\n #23 0x2c606097 ()\n #24 0x1190df62 in v8::internal::`anonymous namespace'::Invoke C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\execution.cc:145\n #25 0x1190d6fa in v8::internal::Execution::Call C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\execution.cc:190\n #26 0x10bfc31b in v8::Script::Run C:\\b\\c\\b\\win_asan_release_media\\src\\v8\\src\\api.cc:2060\n #27 0x1a931a24 in blink::V8ScriptRunner::RunCompiledScript C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\bindings\\core\\v8\\V8ScriptRunner.cpp:573\n #28 0x1a8c4240 in blink::ScriptController::ExecuteScriptAndReturnValue C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\bindings\\core\\v8\\ScriptController.cpp:135\n #29 0x1cbd8c39 in blink::ScheduledAction::Execute C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\bindings\\core\\v8\\ScheduledAction.cpp:161\n #30 0x1cbd83af in blink::ScheduledAction::Execute C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\bindings\\core\\v8\\ScheduledAction.cpp:107\n #31 0x1bca2c17 in blink::DOMTimer::Fired C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\core\\frame\\DOMTimer.cpp:172\n #32 0x16b923b8 in blink::TimerBase::RunInternal C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\platform\\Timer.cpp:174\n #33 0x134b4656 in base::debug::TaskAnnotator::RunTask C:\\b\\c\\b\\win_asan_release_media\\src\\base\\debug\\task_annotator.cc:57\n #34 0x16d84b2d in blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\platform\\scheduler\\base\\task_queue_manager.cc:531\n #35 0x16d7fc8d in blink::scheduler::TaskQueueManager::DoWork C:\\b\\c\\b\\win_asan_release_media\\src\\third_party\\WebKit\\Source\\platform\\scheduler\\base\\task_queue_manager.cc:329\n #36 0x15386db0 in base::internal::Invoker,bool>,void ()>::Run C:\\b\\c\\b\\win_asan_release_media\\src\\base\\bind_internal.h:330\n #37 0x102b5c1b in base::CancelableCallback::Forward C:\\b\\c\\b\\win_asan_release_media\\src\\base\\cancelable_callback.h:109\n #38 0x134b4656 in base::debug::TaskAnnotator::RunTask C:\\b\\c\\b\\win_asan_release_media\\src\\base\\debug\\task_annotator.cc:57\n #39 0x13357e00 in base::MessageLoop::RunTask C:\\b\\c\\b\\win_asan_release_media\\src\\base\\message_loop\\message_loop.cc:422\n #40 0x13358e0b in base::MessageLoop::DeferOrRunPendingTask C:\\b\\c\\b\\win_asan_release_media\\src\\base\\message_loop\\message_loop.cc:433\n #41 0x1335a2df in base::MessageLoop::DoDelayedWork C:\\b\\c\\b\\win_asan_release_media\\src\\base\\message_loop\\message_loop.cc:580\n #42 0x134baf0f in base::MessagePumpDefault::Run C:\\b\\c\\b\\win_asan_release_media\\src\\base\\message_loop\\message_pump_default.cc:37\n #43 0x13356e04 in base::MessageLoop::Run C:\\b\\c\\b\\win_asan_release_media\\src\\base\\message_loop\\message_loop.cc:369\n #44 0x133f2fcb in base::RunLoop::Run C:\\b\\c\\b\\win_asan_release_media\\src\\base\\run_loop.cc:111\n #45 0x181e421f in content::RendererMain C:\\b\\c\\b\\win_asan_release_media\\src\\content\\renderer\\renderer_main.cc:219\n #46 0x132044f8 in content::RunNamedProcessTypeMain C:\\b\\c\\b\\win_asan_release_media\\src\\content\\app\\content_main_runner.cc:411\n #47 0x13205ab7 in content::ContentMainRunnerImpl::Run C:\\b\\c\\b\\win_asan_release_media\\src\\content\\app\\content_main_runner.cc:704\n #48 0x1321722d in service_manager::Main C:\\b\\c\\b\\win_asan_release_media\\src\\services\\service_manager\\embedder\\main.cc:469\n #49 0x132041dc in content::ContentMain C:\\b\\c\\b\\win_asan_release_media\\src\\content\\app\\content_main.cc:19\n #50 0xfe91262 in ChromeMain C:\\b\\c\\b\\win_asan_release_media\\src\\chrome\\app\\chrome_main.cc:119\n #51 0x13584a6 in MainDllLoader::Launch C:\\b\\c\\b\\win_asan_release_media\\src\\chrome\\app\\main_dll_loader_win.cc:199\n #52 0x1351ccb in main C:\\b\\c\\b\\win_asan_release_media\\src\\chrome\\app\\chrome_exe_main_win.cc:268\n #53 0x16c5a59 in __scrt_common_main_seh f:\\dd\\vctools\\crt\\vcstartup\\src\\startup\\exe_common.inl:283\n #54 0x77487c03 in BaseThreadInitThunk+0x23 (C:\\windows\\SYSTEM32\\KERNEL32.DLL+0x17c03)\n #55 0x77a9ad2e in RtlInitializeExceptionChain+0x8e (C:\\windows\\SYSTEM32\\ntdll.dll+0x5ad2e)\n #56 0x77a9acf9 in RtlInitializeExceptionChain+0x59 (C:\\windows\\SYSTEM32\\ntdll.dll+0x5acf9)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: breakpoint C:\\b\\c\\b\\win_asan_release_media\\src\\base\\debug\\debugger_win.cc:18 in base::debug::BreakDebugger\n==2304==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_bus.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_bus.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_bus.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_bus.txt.snap index 9ce4e6883d..4e3bb99285 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_bus.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_bus.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_bus.txt +--- { "text": "#READY\nContent-Type: text/plain\nlayer at (0,0) size 800x600\nLayoutView at (0,0) size 800x600\nlayer at (0,0) size 800x600\nLayoutBlockFlow {HTML} at (0,0) size 800x600\nLayoutBlockFlow {BODY} at (8,8) size 784x584\nlayer at (8,8) size 300x150\nLayoutHTMLCanvas {CANVAS} at (0,0) size 300x150\n#EOF\n#EOF\nASAN:DEADLYSIGNAL\n=================================================================\n==14764==ERROR: AddressSanitizer: BUS on unknown address 0x603000250000 (pc 0x7fff8d0731b6 bp 0x7fff566a69b0 sp 0x7fff566a69a8 T0)\nSCARINESS: 10 (signal)\n#0 0x7fff8d0731b5 in storeColor\n#1 0x7fff8d0834ed in glgProcessColor\n#2 0x7fff8d056628 in __glgProcessPixelsWithProcessor_block_invoke\n#3 0x7fff89222028 in _dispatch_client_callout2\n#4 0x7fff892268c0 in _dispatch_apply_serial\n#5 0x7fff8921040a in _dispatch_client_callout\n#6 0x7fff892215a3 in _dispatch_sync_f_invoke\n#7 0x7fff89221c4b in dispatch_apply_f\n#8 0x7fff8d05641d in glgProcessPixelsWithProcessor\n#9 0x7fff83bc7b02 in gldDoScalingBlit\n#10 0x7fff83bc556b in gldBlitFramebufferData\n#11 0x7fff90432a0a in gleBlitFramebuffer\n#12 0x7fff9037010a in glBlitFramebufferEXT_Exec\n#13 0x7fff8ba2805c in glBlitFramebuffer\n#14 0x10ee0046d in gl::GLApiBase::glBlitFramebufferFn(int, int, int, int, int, int, int, int, unsigned int, unsigned int) ui/gl/gl_bindings_autogen_gl.cc:2627:3\n#15 0x1103dd3f7 in gpu::gles2::GLES2DecoderImpl::DoBlitFramebufferCHROMIUM(int, int, int, int, int, int, int, int, unsigned int, unsigned int) gpu/command_buffer/service/gles2_cmd_decoder.cc:8327:5\n#16 0x11036c86f in gpu::gles2::GLES2DecoderImpl::HandleBlitFramebufferCHROMIUM(unsigned int, void const volatile*) gpu/command_buffer/service/gles2_cmd_decoder_autogen.h:4135:3\n#17 0x1103c180e in gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/gles2_cmd_decoder.cc:5276:18\n#18 0x110291647 in ProcessCommands gpu/command_buffer/service/command_buffer_service.cc:231:17\n#19 0x110291647 in gpu::CommandBufferService::Flush(int) gpu/command_buffer/service/command_buffer_service.cc:86\n#20 0x111498e03 in gpu::GpuCommandBufferStub::OnAsyncFlush(int, unsigned int, std::__1::vector > const&, std::__1::vector > const&) gpu/ipc/service/gpu_command_buffer_stub.cc:973:20\n#21 0x1114984df in DispatchToMethodImpl > &, const std::__1::vector > &), const std::__1::tuple >, std::__1::vector > > &, 0, 1, 2, 3> base/tuple.h:77:3\n#22 0x1114984df in DispatchToMethod > &, const std::__1::vector > &), const std::__1::tuple >, std::__1::vector > > &> base/tuple.h:84\n#23 0x1114984df in DispatchToMethod > &, const std::__1::vector > &), void, std::__1::tuple >, std::__1::vector > > > ipc/ipc_message_templates.h:26\n#24 0x1114984df in bool IPC::MessageT >, std::__1::vector > >, void>::Dispatch > const&, std::__1::vector > const&)>(IPC::Message const*, gpu::GpuCommandBufferStub*, gpu::GpuCommandBufferStub*, void*, void (gpu::GpuCommandBufferStub::*)(int, unsigned int, std::__1::vector > const&, std::__1::vector > const&)) ipc/ipc_message_templates.h:121\n#25 0x111492fbb in gpu::GpuCommandBufferStub::OnMessageReceived(IPC::Message const&) gpu/ipc/service/gpu_command_buffer_stub.cc:303:5\n#26 0x111457821 in HandleMessageHelper gpu/ipc/service/gpu_channel.cc:985:23\n#27 0x111457821 in gpu::GpuChannel::HandleMessageOnQueue() gpu/ipc/service/gpu_channel.cc:960\n#28 0x10e1089d2 in Run base/callback.h:91:12\n#29 0x10e1089d2 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:59\n#30 0x10e1888a2 in base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:414:19\n#31 0x10e189978 in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask) base/message_loop/message_loop.cc:425:5\n#32 0x10e18a3fe in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:513:13\n#33 0x10e198922 in base::MessagePumpCFRunLoopBase::RunWork() base/message_loop/message_pump_mac.mm:421:30\n#34 0x10e1612c9 in base::mac::CallWithEHFrame(void () block_pointer)\n#35 0x10e195c3d in base::MessagePumpCFRunLoopBase::RunWorkSource(void*) base/message_loop/message_pump_mac.mm:397:3\n#36 0x7fff8d289880 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__\n#37 0x7fff8d268fbb in __CFRunLoopDoSources0\n#38 0x7fff8d2684de in __CFRunLoopRun\n#39 0x7fff8d267ed7 in CFRunLoopRunSpecific\n#40 0x10e1999cf in base::MessagePumpCFRunLoop::DoRun(base::MessagePump::Delegate*) base/message_loop/message_pump_mac.mm:639:14\n#41 0x10e1939a6 in base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_mac.mm:141:3\n#42 0x10e2055d9 in base::RunLoop::Run() base/run_loop.cc:111:14\n#43 0x11407e918 in content::GpuMain(content::MainFunctionParams const&) content/gpu/gpu_main.cc:296:21\n#44 0x10a1ff7c7 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:705:12\n#45 0x112a39c54 in service_manager::Main(service_manager::MainParams const&) services/service_manager/embedder/main.cc:469:29\n#46 0x10a1fce46 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:10\n#47 0x10955fa1e in Content Shell Framework:x86_64\n#48 0x7fff8b9d35ac in start\n==14764==Register values:\nrax = 0x0000603000250000 rbx = 0x00007fff8d073238 rcx = 0x0000000000000000 rdx = 0x0000603000250004\nrdi = 0x0000000000000000 rsi = 0x0000000000000016 rbp = 0x00007fff566a69b0 rsp = 0x00007fff566a69a8\nr8 = 0x00007fff566a6e08 r9 = 0x0000000000000000 r10 = 0x0000000000000000 r11 = 0x0000000000000000\nr12 = 0x0000000000000000 r13 = 0x000000000fffc344 r14 = 0x00007fff566a6e08 r15 = 0x0000000000000016\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: BUS (/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib:x86_64+0x251b5)\n==14764==ABORTING\n#CRASHED - gpu\n#EOF\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_container_overflow_read.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_container_overflow_read.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_container_overflow_read.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_container_overflow_read.txt.snap index f7675c9591..01abd7d51f 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_container_overflow_read.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_container_overflow_read.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_container_overflow_read.txt +--- { "text": "=================================================================\n==1==ERROR: AddressSanitizer: container-overflow on address 0x61000006be40 at pc 0x7f45b62d729b bp 0x7ffc5bdf0430 sp 0x7ffc5bdf0428\nREAD of size 4 at 0x61000006be40 thread T0 (chrome)\nSCARINESS: 17 (4-byte-read-container-overflow)\n #0 0x7f45b62d729a in SkSL::Compiler::addDefinitions(SkSL::BasicBlock::Node const&, std::__1::unordered_map >*, std::__1::hash, std::__1::equal_to, std::__1::allocator >*> > >*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCompiler.cpp:211:18\n #1 0x7f45b62e01ee in SkSL::Compiler::scanCFG(SkSL::FunctionDefinition&) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCompiler.cpp:883:23\n #2 0x7f45b62d209a in SkSL::Compiler::internalConvertProgram(SkSL::String, SkSL::Modifiers::Flag*, std::__1::vector >, std::__1::allocator > > >*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCompiler.cpp:922:27\n #3 0x7f45b62e0c29 in SkSL::Compiler::convertProgram(SkSL::Program::Kind, SkSL::String, SkSL::Program::Settings const&) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCompiler.cpp:980:11\n #4 0x7f45b624b14a in GrGLCompileAndAttachShader(GrGLContext const&, unsigned int, unsigned int, char const**, int*, int, GrGpu::Stats*, SkSL::Program::Settings const&, SkSL::Program::Inputs*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/builders/GrGLShaderStringBuilder.cpp:55:28\n #5 0x7f45b6246fb8 in GrGLProgramBuilder::compileAndAttachShaders(GrGLSLShaderBuilder&, unsigned int, unsigned int, SkTDArray*, SkSL::Program::Settings const&, SkSL::Program::Inputs*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/builders/GrGLProgramBuilder.cpp:79:25\n #6 0x7f45b6245e99 in GrGLProgramBuilder::finalize() /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/builders/GrGLProgramBuilder.cpp:144:16\n #7 0x7f45b6244baa in GrGLProgramBuilder::CreateProgram(GrPipeline const&, GrPrimitiveProcessor const&, GrProgramDesc*, GrGLGpu*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/builders/GrGLProgramBuilder.cpp:53:20\n #8 0x7f45b620bfb2 in GrGLGpu::ProgramCache::refProgram(GrGLGpu const*, GrPipeline const&, GrPrimitiveProcessor const&, bool) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/GrGLGpuProgramCache.cpp:95:32\n #9 0x7f45b61daf72 in GrGLGpu::flushGLState(GrPipeline const&, GrPrimitiveProcessor const&, bool) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/GrGLGpu.cpp:1936:47\n #10 0x7f45b61eb3ba in GrGLGpu::draw(GrPipeline const&, GrPrimitiveProcessor const&, GrMesh const*, int) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/GrGLGpu.cpp:2654:16\n #11 0x7f45b66eb53e in GrGpuCommandBuffer::draw(GrPipeline const&, GrPrimitiveProcessor const&, GrMesh const*, int, SkRect const&) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/GrGpuCommandBuffer.cpp:47:11\n #12 0x7f45b60c4803 in GrMeshDrawOp::onExecute(GrOpFlushState*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/ops/GrMeshDrawOp.cpp:80:33\n #13 0x7f45b60224c1 in execute /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/ops/GrOp.h:145:49\n #14 0x7f45b60224c1 in GrRenderTargetOpList::executeOps(GrOpFlushState*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/GrRenderTargetOpList.cpp:172\n #15 0x7f45b5fcf6d1 in GrDrawingManager::internalFlush(GrSurfaceProxy*, GrResourceCache::FlushType) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/GrDrawingManager.cpp:153:26\n #16 0x7f45b5fd03dc in flush /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/GrDrawingManager.h:96:15\n #17 0x7f45b5fd03dc in GrDrawingManager::prepareSurfaceForExternalIO(GrSurfaceProxy*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/GrDrawingManager.cpp:191\n #18 0x7f45b6015d47 in GrRenderTargetContext::prepareForExternalIO() /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/GrRenderTargetContext.cpp:1267:29\n #19 0x7f45c4e6dfee in blink::Canvas2DLayerBridge::Flush() /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp:808:38\n #20 0x7f45c4e7025a in blink::Canvas2DLayerBridge::NewImageSnapshot(blink::AccelerationHint, blink::SnapshotReason) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp:1096:3\n #21 0x7f45c4e6f9b8 in blink::Canvas2DLayerBridge::PrepareTextureMailbox(cc::TextureMailbox*, std::__1::unique_ptr >*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp:932:7\n #22 0x7f45c0cb40e9 in cc::TextureLayer::Update() /mnt/data/b/c/b/ASAN_Release_Media/src/cc/layers/texture_layer.cc:188:18\n #23 0x7f45b7f59558 in PaintContent /mnt/data/b/c/b/ASAN_Release_Media/src/cc/trees/layer_tree_host.cc:1066:33\n #24 0x7f45b7f59558 in cc::LayerTreeHost::DoUpdateLayers(cc::Layer*) /mnt/data/b/c/b/ASAN_Release_Media/src/cc/trees/layer_tree_host.cc:716\n #25 0x7f45b7f5857c in cc::LayerTreeHost::UpdateLayers() /mnt/data/b/c/b/ASAN_Release_Media/src/cc/trees/layer_tree_host.cc:591:17\n #26 0x7f45b8006b8e in cc::ProxyMain::BeginMainFrame(std::__1::unique_ptr >) /mnt/data/b/c/b/ASAN_Release_Media/src/cc/trees/proxy_main.cc:219:60\n #27 0x7f45b819fce6 in Invoke, std::__1::unique_ptr > > /mnt/data/b/c/b/ASAN_Release_Media/src/base/bind_internal.h:214:12\n #28 0x7f45b819fce6 in MakeItSo >), base::WeakPtr, std::__1::unique_ptr > > /mnt/data/b/c/b/ASAN_Release_Media/src/base/bind_internal.h:305\n #29 0x7f45b819fce6 in void base::internal::Invoker >), base::WeakPtr, base::internal::PassedWrapper > > >, void ()>::RunImpl >), std::__1::tuple, base::internal::PassedWrapper > > >, 0ul, 1ul>(void (cc::ProxyMain::*&&)(std::__1::unique_ptr >), std::__1::tuple, base::internal::PassedWrapper > > >&&, base::IndexSequence<0ul, 1ul>) /mnt/data/b/c/b/ASAN_Release_Media/src/base/bind_internal.h:361\n #30 0x7f45b476c264 in Run /mnt/data/b/c/b/ASAN_Release_Media/src/base/callback.h:91:12\n #31 0x7f45b476c264 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) /mnt/data/b/c/b/ASAN_Release_Media/src/base/debug/task_annotator.cc:59\n #32 0x7f45bc7842e6 in blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(blink::scheduler::internal::WorkQueue*, bool, blink::scheduler::LazyNow, base::TimeTicks*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:531:19\n #33 0x7f45bc77e32a in blink::scheduler::TaskQueueManager::DoWork(bool) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:329:13\n #34 0x7f45b476c264 in Run /mnt/data/b/c/b/ASAN_Release_Media/src/base/callback.h:91:12\n #35 0x7f45b476c264 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) /mnt/data/b/c/b/ASAN_Release_Media/src/base/debug/task_annotator.cc:59\n #36 0x7f45b45a1ca6 in base::MessageLoop::RunTask(base::PendingTask*) /mnt/data/b/c/b/ASAN_Release_Media/src/base/message_loop/message_loop.cc:423:19\n #37 0x7f45b45a2afc in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask) /mnt/data/b/c/b/ASAN_Release_Media/src/base/message_loop/message_loop.cc:434:5\n #38 0x7f45b45a3efe in base::MessageLoop::DoWork() /mnt/data/b/c/b/ASAN_Release_Media/src/base/message_loop/message_loop.cc:527:13\n #39 0x7f45b45acfbd in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) /mnt/data/b/c/b/ASAN_Release_Media/src/base/message_loop/message_pump_default.cc:33:31\n #40 0x7f45b45a0ef7 in base::MessageLoop::RunHandler() /mnt/data/b/c/b/ASAN_Release_Media/src/base/message_loop/message_loop.cc:387:10\n #41 0x7f45b462737a in base::RunLoop::Run() /mnt/data/b/c/b/ASAN_Release_Media/src/base/run_loop.cc:37:10\n #42 0x7f45bf19a8a1 in content::RendererMain(content::MainFunctionParams const&) /mnt/data/b/c/b/ASAN_Release_Media/src/content/renderer/renderer_main.cc:200:23\n #43 0x7f45b38648ad in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) /mnt/data/b/c/b/ASAN_Release_Media/src/content/app/content_main_runner.cc:340:14\n #44 0x7f45b3867fa7 in content::ContentMainRunnerImpl::Run() /mnt/data/b/c/b/ASAN_Release_Media/src/content/app/content_main_runner.cc:703:12\n #45 0x7f45b388138d in service_manager::Main(service_manager::MainParams const&) /mnt/data/b/c/b/ASAN_Release_Media/src/services/service_manager/embedder/main.cc:450:29\n #46 0x7f45b3863f2f in content::ContentMain(content::ContentMainParams const&) /mnt/data/b/c/b/ASAN_Release_Media/src/content/app/content_main.cc:19:10\n #47 0x7f45adfd7db3 in ChromeMain /mnt/data/b/c/b/ASAN_Release_Media/src/chrome/app/chrome_main.cc:111:12\n #48 0x7f45a34fff44 in __libc_start_main /build/eglibc-MjiXCM/eglibc-2.19/csu/libc-start.c:287\n0x61000006be40 is located 0 bytes inside of 192-byte region [0x61000006be40,0x61000006bf00)\nallocated by thread T0 (chrome) here:\n #0 0x7f45adfd4da2 in operator new(unsigned long)\n #1 0x7f45b6791d0b in __allocate /mnt/data/b/c/b/ASAN_Release_Media/src/buildtools/third_party/libc++/trunk/include/new:168:10\n #2 0x7f45b6791d0b in allocate /mnt/data/b/c/b/ASAN_Release_Media/src/buildtools/third_party/libc++/trunk/include/memory:1729\n #3 0x7f45b6791d0b in allocate /mnt/data/b/c/b/ASAN_Release_Media/src/buildtools/third_party/libc++/trunk/include/memory:1488\n #4 0x7f45b6791d0b in __split_buffer /mnt/data/b/c/b/ASAN_Release_Media/src/buildtools/third_party/libc++/trunk/include/__split_buffer:311\n #5 0x7f45b6791d0b in void std::__1::vector >::__push_back_slow_path(SkSL::BasicBlock::Node&&) /mnt/data/b/c/b/ASAN_Release_Media/src/buildtools/third_party/libc++/trunk/include/vector:1572\n #6 0x7f45b67890b6 in push_back /mnt/data/b/c/b/ASAN_Release_Media/src/buildtools/third_party/libc++/trunk/include/vector:1613:9\n #7 0x7f45b67890b6 in SkSL::CFGGenerator::addExpression(SkSL::CFG&, std::__1::unique_ptr >*, bool) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCFGGenerator.cpp:373\n #8 0x7f45b678982f in SkSL::CFGGenerator::addExpression(SkSL::CFG&, std::__1::unique_ptr >*, bool) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCFGGenerator.cpp:318:27\n #9 0x7f45b6789bc9 in SkSL::CFGGenerator::addExpression(SkSL::CFG&, std::__1::unique_ptr >*, bool) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCFGGenerator.cpp:394:19\n #10 0x7f45b6789660 in SkSL::CFGGenerator::addExpression(SkSL::CFG&, std::__1::unique_ptr >*, bool) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCFGGenerator.cpp:306:27\n #11 0x7f45b678aa7c in SkSL::CFGGenerator::addStatement(SkSL::CFG&, std::__1::unique_ptr >*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCFGGenerator.cpp:457:19\n #12 0x7f45b678a9cd in SkSL::CFGGenerator::addStatement(SkSL::CFG&, std::__1::unique_ptr >*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCFGGenerator.cpp:433:17\n #13 0x7f45b678a9cd in SkSL::CFGGenerator::addStatement(SkSL::CFG&, std::__1::unique_ptr >*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCFGGenerator.cpp:433:17\n #14 0x7f45b678a9cd in SkSL::CFGGenerator::addStatement(SkSL::CFG&, std::__1::unique_ptr >*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCFGGenerator.cpp:433:17\n #15 0x7f45b67904c8 in SkSL::CFGGenerator::getCFG(SkSL::FunctionDefinition&) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCFGGenerator.cpp:600:11\n #16 0x7f45b62df886 in SkSL::Compiler::scanCFG(SkSL::FunctionDefinition&) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCompiler.cpp:837:30\n #17 0x7f45b62d209a in SkSL::Compiler::internalConvertProgram(SkSL::String, SkSL::Modifiers::Flag*, std::__1::vector >, std::__1::allocator > > >*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCompiler.cpp:922:27\n #18 0x7f45b62e0c29 in SkSL::Compiler::convertProgram(SkSL::Program::Kind, SkSL::String, SkSL::Program::Settings const&) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/sksl/SkSLCompiler.cpp:980:11\n #19 0x7f45b624b14a in GrGLCompileAndAttachShader(GrGLContext const&, unsigned int, unsigned int, char const**, int*, int, GrGpu::Stats*, SkSL::Program::Settings const&, SkSL::Program::Inputs*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/builders/GrGLShaderStringBuilder.cpp:55:28\n #20 0x7f45b6246fb8 in GrGLProgramBuilder::compileAndAttachShaders(GrGLSLShaderBuilder&, unsigned int, unsigned int, SkTDArray*, SkSL::Program::Settings const&, SkSL::Program::Inputs*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/builders/GrGLProgramBuilder.cpp:79:25\n #21 0x7f45b6245e99 in GrGLProgramBuilder::finalize() /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/builders/GrGLProgramBuilder.cpp:144:16\n #22 0x7f45b6244baa in GrGLProgramBuilder::CreateProgram(GrPipeline const&, GrPrimitiveProcessor const&, GrProgramDesc*, GrGLGpu*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/builders/GrGLProgramBuilder.cpp:53:20\n #23 0x7f45b620bfb2 in GrGLGpu::ProgramCache::refProgram(GrGLGpu const*, GrPipeline const&, GrPrimitiveProcessor const&, bool) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/GrGLGpuProgramCache.cpp:95:32\n #24 0x7f45b61daf72 in GrGLGpu::flushGLState(GrPipeline const&, GrPrimitiveProcessor const&, bool) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/GrGLGpu.cpp:1936:47\n #25 0x7f45b61eb3ba in GrGLGpu::draw(GrPipeline const&, GrPrimitiveProcessor const&, GrMesh const*, int) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/gl/GrGLGpu.cpp:2654:16\n #26 0x7f45b66eb53e in GrGpuCommandBuffer::draw(GrPipeline const&, GrPrimitiveProcessor const&, GrMesh const*, int, SkRect const&) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/GrGpuCommandBuffer.cpp:47:11\n #27 0x7f45b60c4803 in GrMeshDrawOp::onExecute(GrOpFlushState*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/ops/GrMeshDrawOp.cpp:80:33\n #28 0x7f45b60224c1 in execute /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/ops/GrOp.h:145:49\n #29 0x7f45b60224c1 in GrRenderTargetOpList::executeOps(GrOpFlushState*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/GrRenderTargetOpList.cpp:172\n #30 0x7f45b5fcf6d1 in GrDrawingManager::internalFlush(GrSurfaceProxy*, GrResourceCache::FlushType) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/GrDrawingManager.cpp:153:26\n #31 0x7f45b5fd03dc in flush /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/GrDrawingManager.h:96:15\n #32 0x7f45b5fd03dc in GrDrawingManager::prepareSurfaceForExternalIO(GrSurfaceProxy*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/GrDrawingManager.cpp:191\n #33 0x7f45b6015d47 in GrRenderTargetContext::prepareForExternalIO() /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/skia/src/gpu/GrRenderTargetContext.cpp:1267:29\n #34 0x7f45c4e6dfee in blink::Canvas2DLayerBridge::Flush() /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp:808:38\n #35 0x7f45c4e7025a in blink::Canvas2DLayerBridge::NewImageSnapshot(blink::AccelerationHint, blink::SnapshotReason) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp:1096:3\n #36 0x7f45c4e6f9b8 in blink::Canvas2DLayerBridge::PrepareTextureMailbox(cc::TextureMailbox*, std::__1::unique_ptr >*) /mnt/data/b/c/b/ASAN_Release_Media/src/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp:932:7\n\nHINT: if you don't care about these errors you may set ASAN_OPTIONS=detect_container_overflow=0.\nIf you suspect a false positive see also: https://github.com/google/sanitizers/wiki/AddressSanitizerContainerOverflow.\nSUMMARY: AddressSanitizer: container-overflow (/mnt/scratch0/clusterfuzz/bot/builds/chrome-test-builds_media_linux-release_eb660d5ee526c9c1c1608a71fcbe7a713c490533/revisions/asan-linux-release-468133/chrome+0xb4e329a)\nShadow bytes around the buggy address:\n 0x0c2080005770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa\n 0x0c2080005780: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd\n 0x0c2080005790: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c20800057a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n 0x0c20800057b0: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\n=>0x0c20800057c0: fa fa fa fa fa fa fa fa[fc]fc fc fc fc fc fc fc\n 0x0c20800057d0: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n 0x0c20800057e0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n 0x0c20800057f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc\n 0x0c2080005800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c2080005810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_double_free.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_double_free.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_double_free.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_double_free.txt.snap index 40c83f8a47..305be53406 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_double_free.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_double_free.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_double_free.txt +--- { "text": "Rendering PDF file /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/bug_649229.pdf.\n=================================================================\n==7009==ERROR: AddressSanitizer: attempting double-free on 0x610000022b80 in thread T0:\nSCARINESS: 42 (double-free)\n #0 0x4f13bb in operator delete(void*)\n #1 0x29f0bb3 in clear third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_countedobject.h:23:5\n #2 0x29f0bb3 in CPDF_DocPageData::Clear(int) third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp:60\n #3 0x29f0168 in CPDF_DocPageData::~CPDF_DocPageData() third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp:36:3\n #4 0x2a2e1bb in CPDF_Document::~CPDF_Document() third_party/pdfium/core/fpdfapi/fpdf_parser/cpdf_document.cpp:422:3\n #5 0x2a2e46a in CPDF_Document::~CPDF_Document() third_party/pdfium/core/fpdfapi/fpdf_parser/cpdf_document.cpp:421:33\n #6 0x4ff389 in RenderPdf(std::__1::basic_string, std::__1::allocator > const&, char const*, unsigned long, Options const&, std::__1::basic_string, std::__1::allocator > const&) third_party/pdfium/samples/pdfium_test.cc:794:3\n #7 0x500f4b in main third_party/pdfium/samples/pdfium_test.cc:918:5\n #8 0x7f4bd1954f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287\n0x610000022b80 is located 0 bytes inside of 120-byte region [0x610000022b80,0x610000022bf8)\nfreed by thread T0 here:\n #0 0x4f13bb in operator delete(void*)\n #1 0x29f75bc in clear third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_countedobject.h:23:5\n #2 0x29f75bc in CPDF_DocPageData::ReleasePattern(CPDF_Object const*) third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp:400\n #3 0x2b1847e in ReleaseBuffer third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_color.cpp:36:20\n #4 0x2b1847e in CPDF_Color::~CPDF_Color() third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_color.cpp:17\n #5 0x2b28835 in ~ColorData third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_colorstate.cpp:147:43\n #6 0x2b28835 in Release third_party/pdfium/core/fxcrt/include/cfx_count_ref.h:64\n #7 0x2b28835 in operator() third_party/pdfium/core/fxcrt/include/fx_memory.h:101\n #8 0x2b28835 in reset buildtools/third_party/libc++/trunk/include/memory:2735\n #9 0x2b28835 in ~unique_ptr buildtools/third_party/libc++/trunk/include/memory:2703\n #10 0x2b28835 in ~CFX_RetainPtr third_party/pdfium/core/fxcrt/include/cfx_retain_ptr.h:13\n #11 0x2b28835 in ~CFX_CountRef third_party/pdfium/core/fxcrt/include/cfx_count_ref.h:20\n #12 0x2b28835 in CPDF_ColorState::~CPDF_ColorState() third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_colorstate.cpp:18\n #13 0x2b2d2c7 in CPDF_GraphicStates::~CPDF_GraphicStates() third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_graphicstates.cpp:11:44\n #14 0x29ebc4d in ~CPDF_PathObject third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_pathobject.cpp:11:38\n #15 0x29ebc4d in CPDF_PathObject::~CPDF_PathObject() third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_pathobject.cpp:11\n #16 0x29eb6be in operator() buildtools/third_party/libc++/trunk/include/memory:2529:13\n #17 0x29eb6be in reset buildtools/third_party/libc++/trunk/include/memory:2735\n #18 0x29eb6be in ~unique_ptr buildtools/third_party/libc++/trunk/include/memory:2703\n #19 0x29eb6be in destroy buildtools/third_party/libc++/trunk/include/memory:1795\n #20 0x29eb6be in __destroy > > buildtools/third_party/libc++/trunk/include/memory:1668\n #21 0x29eb6be in destroy > > buildtools/third_party/libc++/trunk/include/memory:1536\n #22 0x29eb6be in std::__1::__deque_base >, std::__1::allocator > > >::clear() buildtools/third_party/libc++/trunk/include/deque:1171\n #23 0x29ea01c in ~__deque_base buildtools/third_party/libc++/trunk/include/deque:1108:5\n #24 0x29ea01c in CPDF_PageObjectHolder::~CPDF_PageObjectHolder() third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_pageobjectholder.cpp:24\n #25 0x2b2c90a in ~CPDF_Form third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_form.cpp:32:26\n #26 0x2b2c90a in CPDF_Form::~CPDF_Form() third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_form.cpp:32\n #27 0x29e2b72 in operator() buildtools/third_party/libc++/trunk/include/memory:2529:13\n #28 0x29e2b72 in reset buildtools/third_party/libc++/trunk/include/memory:2735\n #29 0x29e2b72 in ~unique_ptr buildtools/third_party/libc++/trunk/include/memory:2703\n #30 0x29e2b72 in ~CPDF_FormObject third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_formobject.cpp:13\n #31 0x29e2b72 in CPDF_FormObject::~CPDF_FormObject() third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_formobject.cpp:13\n #32 0x29eb6be in operator() buildtools/third_party/libc++/trunk/include/memory:2529:13\n #33 0x29eb6be in reset buildtools/third_party/libc++/trunk/include/memory:2735\n #34 0x29eb6be in ~unique_ptr buildtools/third_party/libc++/trunk/include/memory:2703\n #35 0x29eb6be in destroy buildtools/third_party/libc++/trunk/include/memory:1795\n #36 0x29eb6be in __destroy > > buildtools/third_party/libc++/trunk/include/memory:1668\n #37 0x29eb6be in destroy > > buildtools/third_party/libc++/trunk/include/memory:1536\n #38 0x29eb6be in std::__1::__deque_base >, std::__1::allocator > > >::clear() buildtools/third_party/libc++/trunk/include/deque:1171\n #39 0x29ea01c in ~__deque_base buildtools/third_party/libc++/trunk/include/deque:1108:5\n #40 0x29ea01c in CPDF_PageObjectHolder::~CPDF_PageObjectHolder() third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_pageobjectholder.cpp:24\n #41 0x2b2c90a in ~CPDF_Form third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_form.cpp:32:26\n #42 0x2b2c90a in CPDF_Form::~CPDF_Form() third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_form.cpp:32\n #43 0x2b3b0c2 in operator() buildtools/third_party/libc++/trunk/include/memory:2529:13\n #44 0x2b3b0c2 in reset buildtools/third_party/libc++/trunk/include/memory:2735\n #45 0x2b3b0c2 in ~unique_ptr buildtools/third_party/libc++/trunk/include/memory:2703\n #46 0x2b3b0c2 in ~CPDF_TilingPattern third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_tilingpattern.cpp:25\n #47 0x2b3b0c2 in CPDF_TilingPattern::~CPDF_TilingPattern() third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_tilingpattern.cpp:24\n #48 0x29f0bb3 in clear third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_countedobject.h:23:5\n #49 0x29f0bb3 in CPDF_DocPageData::Clear(int) third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp:60\n #50 0x29f0168 in CPDF_DocPageData::~CPDF_DocPageData() third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp:36:3\n #51 0x2a2e1bb in CPDF_Document::~CPDF_Document() third_party/pdfium/core/fpdfapi/fpdf_parser/cpdf_document.cpp:422:3\n #52 0x2a2e46a in CPDF_Document::~CPDF_Document() third_party/pdfium/core/fpdfapi/fpdf_parser/cpdf_document.cpp:421:33\n #53 0x4ff389 in RenderPdf(std::__1::basic_string, std::__1::allocator > const&, char const*, unsigned long, Options const&, std::__1::basic_string, std::__1::allocator > const&) third_party/pdfium/samples/pdfium_test.cc:794:3\n #54 0x500f4b in main third_party/pdfium/samples/pdfium_test.cc:918:5\n #55 0x7f4bd1954f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287\npreviously allocated by thread T0 here:\n #0 0x4f077b in operator new(unsigned long)\n #1 0x29f69ae in CPDF_DocPageData::GetPattern(CPDF_Object*, int, CFX_Matrix const&) third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_doc.cpp:364:20\n #2 0x2b74359 in CPDF_StreamContentParser::FindPattern(CFX_ByteString const&, bool) third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_parser.cpp:1198:23\n #3 0x2b69b69 in CPDF_StreamContentParser::Handle_SetColorPS_Fill() third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_parser.cpp:1038:30\n #4 0x2b762eb in CPDF_StreamContentParser::Parse(unsigned char const*, unsigned int, unsigned int) third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_parser.cpp:1513:9\n #5 0x2a05e71 in CPDF_ContentParser::Continue(IFX_Pause*) third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_parser_old.cpp:782:24\n #6 0x29ea33b in CPDF_PageObjectHolder::ContinueParse(IFX_Pause*) third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_pageobjectholder.cpp:30:14\n #7 0x2aa80e1 in CPDF_RenderStatus::LoadSMask(CPDF_Dictionary*, FX_RECT*, CFX_Matrix const*) third_party/pdfium/core/fpdfapi/fpdf_render/fpdf_render_image.cpp:977:8\n #8 0x2a89e4b in CPDF_RenderStatus::ProcessTransparency(CPDF_PageObject*, CFX_Matrix const*) third_party/pdfium/core/fpdfapi/fpdf_render/fpdf_render.cpp:813:9\n #9 0x2a8af74 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject*, CFX_Matrix const*, IFX_Pause*) third_party/pdfium/core/fpdfapi/fpdf_render/fpdf_render.cpp:300:7\n #10 0x2a9516e in CPDF_ProgressiveRenderer::Continue(IFX_Pause*) third_party/pdfium/core/fpdfapi/fpdf_render/fpdf_render.cpp:1044:30\n #11 0x2904ec4 in FPDF_RenderPage_Retail(CPDF_PageRenderContext*, void*, int, int, int, int, int, int, int, IFSDK_PAUSE_Adapter*) third_party/pdfium/fpdfsdk/fpdfview.cpp:906:26\n #12 0x2904346 in FPDF_RenderPageBitmap third_party/pdfium/fpdfsdk/fpdfview.cpp:642:3\n #13 0x4fd5f2 in RenderPage(std::__1::basic_string, std::__1::allocator > const&, void*, void*&, FPDF_FORMFILLINFO_PDFiumTest&, int, Options const&, std::__1::basic_string, std::__1::allocator > const&) third_party/pdfium/samples/pdfium_test.cc:589:5\n #14 0x4ff730 in RenderPdf(std::__1::basic_string, std::__1::allocator > const&, char const*, unsigned long, Options const&, std::__1::basic_string, std::__1::allocator > const&) third_party/pdfium/samples/pdfium_test.cc:778:9\n #15 0x500f4b in main third_party/pdfium/samples/pdfium_test.cc:918:5\n #16 0x7f4bd1954f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287\nSUMMARY: AddressSanitizer: double-free (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-asan_linux-release_4392242b7f59878a2775b4607420a2b37e17ff13/symbolized/release/asan-linux-release-420300/pdfium_test+0x4f13bb)\n==7009==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_fpe.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_fpe.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_fpe.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_fpe.txt.snap index 108ff491af..4cec9942de 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_fpe.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_fpe.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_fpe.txt +--- { "text": "ASAN:DEADLYSIGNAL\n=================================================================\n==13370==ERROR: AddressSanitizer: FPE on unknown address 0x7fdc48869a7c (pc 0x7fdc48869a7c bp 0x7ffdcfaf8350 sp 0x7ffdcfaf8240 T0)\n #0 0x7fdc48869a7b in ash::WindowGrid::PositionWindows(bool) ash/wm/overview/window_grid.cc:252:49\n #1 0x7fdc487fd825 in ash::WindowSelector::Init(std::vector > const&) ash/wm/overview/window_selector.cc:309:7\n #2 0x7fdc4865e376 in ash::WindowSelectorController::ToggleOverview() ash/wm/overview/window_selector_controller.cc:62:5\n #3 0x7fdc4838639b in HandleToggleOverview ash/accelerators/accelerator_controller.cc:394:3\n #4 0x7fdc4838639b in ash::AcceleratorController::PerformAction(ash::AcceleratorAction, ui::Accelerator const&) ash/accelerators/accelerator_controller.cc:1089\n #5 0x7fdc4838a67d in ash::AcceleratorController::AcceleratorPressed(ui::Accelerator const&) ash/accelerators/accelerator_controller.cc:733:5\n #6 0x7fdc50d8fa5e in ui::AcceleratorManager::Process(ui::Accelerator const&) ui/base/accelerators/accelerator_manager.cc:88:11\n #7 0x7fdc4838186f in ash::AcceleratorController::Process(ui::Accelerator const&) ash/accelerators/accelerator_controller.cc:658:12\n #8 0x7fdc486dcce9 in ash::AcceleratorDelegate::ProcessAccelerator(ui::KeyEvent const&, ui::Accelerator const&, wm::AcceleratorDelegate::KeyType) ash/accelerators/accelerator_delegate.cc:32:5\n #9 0x7fdc4b28c7a3 in wm::AcceleratorFilter::OnKeyEvent(ui::KeyEvent*) ui/wm/core/accelerator_filter.cc:70:7\n #10 0x7fdc50e13d50 in ui::EventHandler::OnEvent(ui::Event*) ui/events/event_handler.cc:37:5\n #11 0x7fdc50e11b4e in DispatchEvent ui/events/event_dispatcher.cc:189:3\n #12 0x7fdc50e11b4e in ui::EventDispatcher::DispatchEventToEventHandlers(std::vector >*, ui::Event*) ui/events/event_dispatcher.cc:168\n #13 0x7fdc50e10256 in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:126:3\n #14 0x7fdc50e0fa70 in DispatchEventToTarget ui/events/event_dispatcher.cc:85:3\n #15 0x7fdc50e0fa70 in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:57\n #16 0x7fdc50e1480b in ui::EventProcessor::OnEventFromSource(ui::Event*) ui/events/event_processor.cc:35:15\n #17 0x7fdc4846d17c in DispatchKeyEventPostIME ash/host/ash_window_tree_host_x11.cc:243:7\n #18 0x7fdc4846d17c in non-virtual thunk to ash::AshWindowTreeHostX11::DispatchKeyEventPostIME(ui::KeyEvent*) ash/host/ash_window_tree_host_x11.cc:239\n #19 0x7fdc5144470f in ui::InputMethodBase::DispatchKeyEventPostIME(ui::KeyEvent*) const ui/base/ime/input_method_base.cc:111:15\n #20 0x7fdc514319d1 in ui::InputMethodChromeOS::ProcessUnfilteredKeyPressEvent(ui::KeyEvent*) ui/base/ime/input_method_chromeos.cc:395:17\n #21 0x7fdc51431297 in ui::InputMethodChromeOS::DispatchKeyEvent(ui::KeyEvent*) ui/base/ime/input_method_chromeos.cc:130:7\n #22 0x7fdc4846f5f9 in ash::InputMethodEventHandler::OnKeyEvent(ui::KeyEvent*) ash/ime/input_method_event_handler.cc:35:3\n #23 0x7fdc50e13d50 in ui::EventHandler::OnEvent(ui::Event*) ui/events/event_handler.cc:37:5\n #24 0x7fdc50e11b4e in DispatchEvent ui/events/event_dispatcher.cc:189:3\n #25 0x7fdc50e11b4e in ui::EventDispatcher::DispatchEventToEventHandlers(std::vector >*, ui::Event*) ui/events/event_dispatcher.cc:168\n #26 0x7fdc50e10256 in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:126:3\n #27 0x7fdc50e0fa70 in DispatchEventToTarget ui/events/event_dispatcher.cc:85:3\n #28 0x7fdc50e0fa70 in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:57\n #29 0x7fdc50e1480b in ui::EventProcessor::OnEventFromSource(ui::Event*) ui/events/event_processor.cc:35:15\n #30 0x7fdc50e1642b in DeliverEventToProcessor ui/events/event_source.cc:73:10\n #31 0x7fdc50e1642b in ui::EventSource::SendEventToProcessor(ui::Event*) ui/events/event_source.cc:51\n #32 0x7fdc5144d04c in aura::WindowTreeHostX11::DispatchEvent(_XEvent* const&) ui/aura/window_tree_host_x11.cc:343:9\n #33 0x7fdc3d35fd47 in ui::PlatformEventSource::DispatchEvent(_XEvent*) ui/events/platform/platform_event_source.cc:82:18\n #34 0x7fdc50ea2348 in ui::X11EventSource::DispatchEvent(_XEvent*) ui/events/platform/x11/x11_event_source.cc:136:21\n #35 0x7fdc50ea1c22 in ExtractCookieDataDispatchEvent ui/events/platform/x11/x11_event_source.cc:129:21\n #36 0x7fdc50ea1c22 in ui::X11EventSource::DispatchXEvents() ui/events/platform/x11/x11_event_source.cc:106\n #37 0x7fdc50ea108a in ui::(anonymous namespace)::XSourceDispatch(_GSource*, int (*)(void*), void*) ui/events/platform/x11/x11_event_source_glib.cc:39:3\n #38 0x7fdc3512bce4 in g_main_context_dispatch\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: FPE (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-asan_linux-release-chromeos_4392242b7f59878a2775b4607420a2b37e17ff13/symbolized/release/asan-linux-release-344814/chrome+0x127f6a7b)\n==13370==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_gsignal.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_gsignal.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_gsignal.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_gsignal.txt.snap index 0687a5263e..737c4365ce 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_gsignal.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_gsignal.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_gsignal.txt +--- { "text": "=================================================================\n==14797==ERROR: AddressSanitizer: SEGV on unknown address 0x03e9000039cd (pc 0x7f96fbdfec37 bp 0x7ffe5a1e1a00 sp 0x7ffe5a1e18c8 T0)\nSCARINESS: 10 (signal)\n #0 0x7f96fbdfec36 in gsignal /build/eglibc-oGUzwX/eglibc-2.19/signal/../nptl/sysdeps/unix/sysv/linux/raise.c:56\n #1 0x6c7e47 in base::debug::BreakDebugger() base/debug/debugger_posix.cc:249:3\n #2 0x5ed74e in logging::LogMessage::~LogMessage() base/logging.cc:748:7\n #3 0xe099d8 in url::(anonymous namespace)::UIDNAWrapper::UIDNAWrapper() url/url_canon_icu.cc:104:7\n #4 0xe09601 in base::DefaultLazyInstanceTraits::New(void*) base/lazy_instance.h:69:27\n #5 0xe092bd in base::internal::LeakyLazyInstanceTraits::New(void*) base/lazy_instance.h:98:12\n #6 0xe09240 in base::LazyInstance >::Pointer() base/lazy_instance.h:163:11\n #7 0xe08b3d in base::LazyInstance >::Get() base/lazy_instance.h:137:13\n #8 0xe0838a in url::IDNToASCII(unsigned short const*, int, url::CanonOutputT*) url/url_canon_icu.cc:168:26\n #9 0xddb90d in url::(anonymous namespace)::DoIDNHost(unsigned short const*, int, url::CanonOutputT*) url/url_canon_host.cc:177:8\n #10 0xddb608 in url::(anonymous namespace)::DoComplexHost(char const*, int, bool, bool, url::CanonOutputT*) url/url_canon_host.cc:275:10\n #11 0xdd8f0d in void url::(anonymous namespace)::DoHost(char const*, url::Component const&, url::CanonOutputT*, url::Ca\nnonHostInfo*) url/url_canon_host.cc:335:15\n #12 0xdd8471 in url::CanonicalizeHost(char const*, url::Component const&, url::CanonOutputT*, url::Component*) url/url_canon_host.cc:370:3\n #13 0xdf3a7a in bool url::(anonymous namespace)::DoCanonicalizeStandardURL(url::URLComponentSource const&, url::Parsed \nconst&, url::CharsetConverter*, url::CanonOutputT*, url::Parsed*) url/url_canon_stdurl.cc:45:16\n #14 0xdf349c in url::CanonicalizeStandardURL(char const*, int, url::Parsed const&, url::CharsetConverter*, url::CanonOutputT*, url::Parsed*)\n url/url_canon_stdurl.cc:133:10\n #15 0xdfbd76 in bool url::(anonymous namespace)::DoCanonicalize(char const*, int, bool, url::CharsetConverter*, url::CanonOutputT*, ur\nl::Parsed*) url/url_util.cc:210:15\n #16 0xdfb5be in url::Canonicalize(char const*, int, bool, url::CharsetConverter*, url::CanonOutputT*, url::Parsed*) url/url_util.cc:497:10\n #17 0xdb4a30 in void GURL::InitCanonical, std::__1::allocator > >(base::BasicString\nPiece, std::__1::allocator > >, bool) url/gurl.cc:115:15\n #18 0xda1571 in GURL::GURL(base::BasicStringPiece, std::__1::allocator > >) url/gur\nl.cc:82:3\n #19 0x4ef46f in LLVMFuzzerTestOneInput net/base/parse_data_url_fuzzer.cc:17:23\n #20 0x531764 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:488:13\n #21 0x52d5a6 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:444:3\n #22 0x4f1203 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*) third_party/libFuzzer/src/FuzzerDriver.cpp:257:6\n #23 0x4f4f75 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:379:9\n #24 0x57316e in main third_party/libFuzzer/src/FuzzerMain.cpp:21:10\n #25 0x7f96fbde9f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /build/eglibc-oGUzwX/eglibc-2.19/signal/../nptl/sysdeps/unix/sysv/linux/raise.c:56 in gsignal\n==14797==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_heap_overflow_read.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_heap_overflow_read.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_heap_overflow_read.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_heap_overflow_read.txt.snap index bda52d718f..18d97ab067 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_heap_overflow_read.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_heap_overflow_read.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_heap_overflow_read.txt +--- { "text": "\n=================================================================\n==14970==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61b00001f7d0 at pc 0x00000064801b bp 0x7ffce478dbd0 sp 0x7ffce478dbc8\nREAD of size 4 at 0x61b00001f7d0 thread T0\n #0 0x64801a in read_scalar(unsigned int const*&) third_party/skia/src/core/SkPaint.cpp:1819:15\n #1 0x647ac5 in SkPaint::unflatten(SkReadBuffer&) third_party/skia/src/core/SkPaint.cpp:1954:25\n #2 0xb1dee7 in SkLayerRasterizer::ReadLayers(SkReadBuffer&) third_party/skia/src/effects/SkLayerRasterizer.cpp:160:9\n #3 0xb1ddd8 in SkLayerRasterizer::CreateProc(SkReadBuffer&) third_party/skia/src/effects/SkLayerRasterizer.cpp:149:34\n #4 0x706252 in SkValidatingReadBuffer::readFlattenable(SkFlattenable::Type) third_party/skia/src/core/SkValidatingReadBuffer.cpp:250:15\n #5 0x647d54 in SkPaint::unflatten(SkReadBuffer&) third_party/skia/src/core/SkPaint.cpp:1980:41\n #6 0xb566e7 in SkPaintImageFilter::CreateProc(SkReadBuffer&) third_party/skia/src/effects/SkPaintImageFilter.cpp:27:5\n #7 0x706252 in SkValidatingReadBuffer::readFlattenable(SkFlattenable::Type) third_party/skia/src/core/SkValidatingReadBuffer.cpp:250:15\n #8 0x5d76cc in SkImageFilter::Common::unflatten(SkReadBuffer&, int) third_party/skia/src/core/SkImageFilter.cpp:162:26\n #9 0xb50660 in SkDilateImageFilter::CreateProc(SkReadBuffer&) third_party/skia/src/effects/SkMorphologyImageFilter.cpp:169:5\n #10 0x706252 in SkValidatingReadBuffer::readFlattenable(SkFlattenable::Type) third_party/skia/src/core/SkValidatingReadBuffer.cpp:250:15\n #11 0x5d76cc in SkImageFilter::Common::unflatten(SkReadBuffer&, int) third_party/skia/src/core/SkImageFilter.cpp:162:26\n #12 0xb50320 in SkErodeImageFilter::CreateProc(SkReadBuffer&) third_party/skia/src/effects/SkMorphologyImageFilter.cpp:162:5\n #13 0x706252 in SkValidatingReadBuffer::readFlattenable(SkFlattenable::Type) third_party/skia/src/core/SkValidatingReadBuffer.cpp:250:15\n #14 0x5d76cc in SkImageFilter::Common::unflatten(SkReadBuffer&, int) third_party/skia/src/core/SkImageFilter.cpp:162:26\n #15 0xb55d56 in SkOffsetImageFilter::CreateProc(SkReadBuffer&) third_party/skia/src/effects/SkOffsetImageFilter.cpp:94:5\n #16 0x706252 in SkValidatingReadBuffer::readFlattenable(SkFlattenable::Type) third_party/skia/src/core/SkValidatingReadBuffer.cpp:250:15\n #17 0x5d76cc in SkImageFilter::Common::unflatten(SkReadBuffer&, int) third_party/skia/src/core/SkImageFilter.cpp:162:26\n #18 0xae7c85 in SkBlurImageFilter::CreateProc(SkReadBuffer&) third_party/skia/src/effects/SkBlurImageFilter.cpp:43:5\n #19 0x706252 in SkValidatingReadBuffer::readFlattenable(SkFlattenable::Type) third_party/skia/src/core/SkValidatingReadBuffer.cpp:250:15\n #20 0x5d76cc in SkImageFilter::Common::unflatten(SkReadBuffer&, int) third_party/skia/src/core/SkImageFilter.cpp:162:26\n #21 0xb68fc8 in SkXfermodeImageFilter::CreateProc(SkReadBuffer&) third_party/skia/src/effects/SkXfermodeImageFilter.cpp:37:5\n #22 0x706252 in SkValidatingReadBuffer::readFlattenable(SkFlattenable::Type) third_party/skia/src/core/SkValidatingReadBuffer.cpp:250:15\n #23 0x5d76cc in SkImageFilter::Common::unflatten(SkReadBuffer&, int) third_party/skia/src/core/SkImageFilter.cpp:162:26\n #24 0xb4ce8d in SkMergeImageFilter::CreateProc(SkReadBuffer&) third_party/skia/src/effects/SkMergeImageFilter.cpp:127:10\n #25 0x706252 in SkValidatingReadBuffer::readFlattenable(SkFlattenable::Type) third_party/skia/src/core/SkValidatingReadBuffer.cpp:250:15\n #26 0x5d0544 in SkValidatingDeserializeFlattenable(void const*, unsigned long, SkFlattenable::Type) third_party/skia/src/core/SkFlattenableSerialization.cpp:26:12\n #27 0x4e2325 in (anonymous namespace)::RunTestCase(std::__1::basic_string, std::__1::allocator >&, SkBitmap&, SkCanvas*) skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:31:32\n #28 0x4e17c9 in (anonymous namespace)::ReadAndRunTestCase(char const*, SkBitmap&, SkCanvas*) skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:66:3\n #29 0x4e1313 in main skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:85:10\n #30 0x7efeb0640ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\n0x61b00001f7d0 is located 0 bytes to the right of 1616-byte region [0x61b00001f180,0x61b00001f7d0)\nallocated by thread T0 here:\n #0 0x4df1eb in operator new(unsigned long)\n #1 0x7efeb0fcdd77 (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-asan_linux-release_4392242b7f59878a2775b4607420a2b37e17ff13/symbolized/release/asan-symbolized-linux-release-368762/lib/libc++.so+0x1b5d77)\n #2 0x7efeb0fcd3f9 (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-asan_linux-release_4392242b7f59878a2775b4607420a2b37e17ff13/symbolized/release/asan-symbolized-linux-release-368762/lib/libc++.so+0x1b53f9)\n #1 0x4e9382 in base::ReadFileToString(base::FilePath const&, std::__1::basic_string, std::__1::allocator >*, unsigned long) base/files/file_util.cc:149:7\n #2 0x4e1f0a in (anonymous namespace)::ReadTestCase(char const*, std::__1::basic_string, std::__1::allocator >*) skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:19:8\n #3 0x4e17a7 in (anonymous namespace)::ReadAndRunTestCase(char const*, SkBitmap&, SkCanvas*) skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:63:8\n #4 0x4e1313 in main skia/tools/filter_fuzz_stub/filter_fuzz_stub.cc:85:10\n #5 0x7efeb0640ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-asan_linux-release_4392242b7f59878a2775b4607420a2b37e17ff13/symbolized/release/asan-symbolized-linux-release-368762/filter_fuzz_stub+0x64801a)\nShadow bytes around the buggy address:\n 0x0c367fffbea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x0c367fffbeb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x0c367fffbec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x0c367fffbed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x0c367fffbee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x0c367fffbef0: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa\n 0x0c367fffbf00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c367fffbf10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c367fffbf20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c367fffbf30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c367fffbf40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap left redzone: fa\n Heap right redzone: fb\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack partial redzone: f4\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n==14970==ABORTING\n\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_heap_overflow_write.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_heap_overflow_write.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_heap_overflow_write.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_heap_overflow_write.txt.snap index 2bb224cbd4..4c44f46ab6 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_heap_overflow_write.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_heap_overflow_write.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_heap_overflow_write.txt +--- { "text": "=================================================================\n==3216==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x0d37d6e0 at pc 0x013de06e bp 0xdeadbeef sp 0x00b6d550\nWRITE of size 16 at 0x0d37d6e0 thread T0\n==3216==*** WARNING: Failed to initialize DbgHelp! ***\n==3216==*** Most likely this means that the app is already ***\n==3216==*** using DbgHelp, possibly with incompatible flags. ***\n==3216==*** Due to technical reasons, symbolization might crash ***\n==3216==*** or produce wrong results. ***\n #0 0x13de084 in __asan_memset+0xe4 (C:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_a15986b6468dcac5c0ae9a2e0729fd95d8ce33c8\\symbolized\\release\\asan-win32-release-367086\\chrome.exe+0x6ae084)\n #1 0x1ad13757 in blink::TimerBase::stop third_party/WebKit/Source/platform/Timer.cpp:73\n #2 0x13792007 in blink::HTMLInputElement::onSearch third_party/WebKit/Source/core/html/HTMLInputElement.cpp:1487\n #3 0x1ce8bdfd in blink::internal::CallClosureTask::performTask components/scheduler/child/webthread_base.cc:26\n #4 0x13614ffc in blink::MainThreadTaskRunner::perform third_party/WebKit/Source/core/dom/MainThreadTaskRunner.cpp:105\n #5 0x13614e02 in blink::MainThreadTask::run third_party/WebKit/Source/core/dom/MainThreadTaskRunner.cpp:61\n #6 0x1ce88f9b in scheduler::WebTaskRunnerImpl::runTask components/scheduler/child/web_task_runner_impl.cc:49\n #7 0x1ce89bac in base::internal::RunnableAdapter >)>::Run base/bind_internal.h:157\n #8 0x1ce89a83 in base::internal::InvokeHelper<0,void,base::internal::RunnableAdapter >)>,base::internal::TypeList > > >::MakeItSo base/bind_internal.h:297\n #9 0x1ce898c9 in base::internal::Invoker,base::internal::BindState >)>,void __cdecl(scoped_ptr >),base::internal::PassedWrapper > > >,base::internal::TypeList > > > >,base::internal::InvokeHelper<0,void,base::internal::RunnableAdapter >)>,base::internal::TypeList > > >,void __cdecl(void)>::Run base/bind_internal.h:347\n #10 0x1047ecd1 in base::debug::TaskAnnotator::RunTask base/callback.h:394\n #11 0x1ced7fc4 in scheduler::TaskQueueManager::ProcessTaskFromWorkQueue components/scheduler/base/task_queue_manager.cc:264\n #12 0x1ced265e in scheduler::TaskQueueManager::DoWork components/scheduler/base/task_queue_manager.cc:180\n #13 0x1cededaa in base::internal::Invoker,base::internal::BindState,void __cdecl(scheduler::TaskQueueManager *,base::TimeTicks,bool),base::WeakPtr,base::TimeTicks,bool>,base::internal::TypeList >,base::internal::UnwrapTraits,base::internal::UnwrapTraits >,base::internal::InvokeHelper<1,void,base::internal::RunnableAdapter,base::internal::TypeList const &,base::TimeTicks const &,bool const &> >,void __cdecl(void)>::Run base/bind_internal.h:178\n #14 0x1047ecd1 in base::debug::TaskAnnotator::RunTask base/callback.h:394\n #15 0x10375759 in base::MessageLoop::RunTask base/message_loop/message_loop.cc:488\n #16 0x10376cf6 in base::MessageLoop::DoWork base/message_loop/message_loop.cc:497\n #17 0x10486577 in base::MessagePumpDefault::Run base/message_loop/message_pump_default.cc:33\n #18 0x10374693 in base::MessageLoop::RunHandler base/message_loop/message_loop.cc:452\n #19 0x10486c66 in base::RunLoop::Run base/run_loop.cc:56\n #20 0x10373635 in base::MessageLoop::Run base/message_loop/message_loop.cc:290\n #21 0x169d1812 in content::RendererMain content/renderer/renderer_main.cc:232\n #22 0x10262f5d in content::RunNamedProcessTypeMain content/app/content_main_runner.cc:383\n #23 0x102650b2 in content::ContentMainRunnerImpl::Run content/app/content_main_runner.cc:795\n #24 0x10262b2b in content::ContentMain content/app/content_main.cc:19\n #25 0xfe7113b in ChromeMain chrome/app/chrome_main.cc:67\n #26 0x113fe80 in MainDllLoader::Launch chrome/app/main_dll_loader_win.cc:285\n #27 0x1133873 in main chrome/app/chrome_exe_main_win.cc:219\n #28 0x13f9dfa in __tmainCRTStartup f:\\dd\\vctools\\crt\\crtw32\\startup\\crt0.c:255\n #29 0x77157c03 in BaseThreadInitThunk+0x23 (C:\\windows\\SYSTEM32\\KERNEL32.DLL+0x6b817c03)\n #30 0x778aad5e in RtlInitializeExceptionChain+0x8e (C:\\windows\\SYSTEM32\\ntdll.dll+0x6b2dad5e)\n #31 0x778aad29 in RtlInitializeExceptionChain+0x59 (C:\\windows\\SYSTEM32\\ntdll.dll+0x6b2dad29)\n\n0x0d37d6e0 is located 12 bytes to the right of 20-byte region [0x0d37d6c0,0x0d37d6d4)\nallocated by thread T0 here:\n #0 0x13e3298 in malloc+0xb8 (C:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_a15986b6468dcac5c0ae9a2e0729fd95d8ce33c8\\symbolized\\release\\asan-win32-release-367086\\chrome.exe+0x6b3298)\n #1 0x13b4bad3 in blink::PasswordInputType::create third_party/WebKit/Source/wtf/PartitionAlloc.h:736\n #2 0x13993883 in blink::InputType::create third_party/WebKit/Source/core/html/forms/InputType.cpp:120\n #3 0x1377dd48 in blink::HTMLInputElement::updateType third_party/WebKit/Source/core/html/HTMLInputElement.cpp:461\n #4 0x1378614d in blink::HTMLInputElement::parseAttribute third_party/WebKit/Source/core/html/HTMLInputElement.cpp:689\n #5 0x1342d2bc in blink::Element::attributeChanged third_party/WebKit/Source/core/dom/Element.cpp:1197\n #6 0x13456147 in blink::Element::didModifyAttribute third_party/WebKit/Source/core/dom/Element.cpp:3136\n #7 0x1342bb31 in blink::Element::setAttribute third_party/WebKit/Source/core/dom/Element.cpp:1180\n #8 0x1622da4c in blink::V8IdleRequestCallback::`vector deleting destructor out/Release/gen/blink/bindings/core/v8/V8Element.cpp:1150\n #9 0x1c2497aa in v8::internal::FunctionCallbackArguments::Call v8/src/arguments.cc:33\n #10 0x1b2504de in v8::internal::Builtins::InvokeApiFunction v8/src/builtins.cc:2208\n #11 0x1b277710 in v8::internal::Runtime_SetAllocationTimeout v8/src/builtins.cc:2232\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (C:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_a15986b6468dcac5c0ae9a2e0729fd95d8ce33c8\\symbolized\\release\\asan-win32-release-367086\\chrome.exe+0x6ae084) in __asan_memset+0xe4\nShadow bytes around the buggy address:\n 0x31a6fa80: fa fa fa fa fa fa fa fa fd fd fd fd fa fa fa fa\n 0x31a6fa90: fa fa fa fa fa fa fa fa fa fa fa fa 00 00 00 00\n 0x31a6faa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x31a6fab0: 00 00 04 fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x31a6fac0: fa fa fa fa fd fd fd fd fa fa fa fa fa fa fa fa\n=>0x31a6fad0: fa fa fa fa fa fa fa fa 00 00 04 fa[fa]fa fa fa\n 0x31a6fae0: fa fa fa fa fa fa fa fa fa fa fa fa fd fd fd fa\n 0x31a6faf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x31a6fb00: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa\n 0x31a6fb10: fa fa fa fa fd fd fd fd fa fa fa fa fa fa fa fa\n 0x31a6fb20: fa fa fa fa fa fa fa fa 00 00 00 04 fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap left redzone: fa\n Heap right redzone: fb\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack partial redzone: f4\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n==3216==ABORTING\n[1229/173339:ERROR:main_dll_loader_win.cc(299)] Could not find exported function RelaunchChromeBrowserWithNewCommandLineIfNeeded\n \n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_ill.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_ill.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_ill.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_ill.txt.snap index 18041eb460..9a7183f33d 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_ill.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_ill.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_ill.txt +--- { "text": "$ ASAN_OPTIONS=handle_sigill=1:symbolize=1 ~/chromium/src/out/Release/v8_wasm_code_fuzzer ./clusterfuzz-testcase-6080637904879616 \nINFO: Seed: 56440552\nINFO: Loaded 0 modules (0 guards): \n/home/user/chromium/src/out/Release/v8_wasm_code_fuzzer: Running 1 inputs 1 time(s) each.\nRunning: ./clusterfuzz-testcase-6080637904879616\nASAN:DEADLYSIGNAL\n=================================================================\n==89063==ERROR: AddressSanitizer: ILL on unknown address 0x631000001001 (pc 0x631000001001 bp 0x7ffd2297fd70 sp 0x7ffd2297fd58 T0)\n #0 0x631000001000 ()\n #1 0x4f6b78 in boom_internal() v8/test/fuzzer/wasm-code.cc:76:7\n #2 0x4f6c08 in boom_intermediate() v8/test/fuzzer/wasm-code.cc:83:14\n #3 0x4f6c38 in boom() v8/test/fuzzer/wasm-code.cc:87:7\n #4 0x4f6cd3 in LLVMFuzzerTestOneInput v8/test/fuzzer/wasm-code.cc:100:6\n #5 0x5125bd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:550:13\n #6 0x512aeb in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:501:3\n #7 0x4f7997 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:268:6\n #8 0x4faa80 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:517:9\n #9 0x51a108 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10\n #10 0x7fc7047d7f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ILL () \n==89063==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_ill_null_address.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_ill_null_address.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_ill_null_address.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_ill_null_address.txt.snap index 0965ec17a1..81604e4296 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_ill_null_address.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_ill_null_address.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_ill_null_address.txt +--- { "text": "$ ASAN_OPTIONS=handle_sigill=1:symbolize=1 ~/chromium/src/out/Release/v8_wasm_code_fuzzer ./clusterfuzz-testcase-6080637904879616 \nINFO: Seed: 56440552\nINFO: Loaded 0 modules (0 guards): \n/home/user/chromium/src/out/Release/v8_wasm_code_fuzzer: Running 1 inputs 1 time(s) each.\nRunning: ./clusterfuzz-testcase-6080637904879616\nASAN:DEADLYSIGNAL\n=================================================================\n==89063==ERROR: AddressSanitizer: ILL on unknown address 0x000000000000 (pc 0x000000000000 bp 0x7ffd2297fd70 sp 0x7ffd2297fd58 T0)\n #0 0x000000000000 ()\n #1 0x4f6b78 in boom_internal() v8/test/fuzzer/wasm-code.cc:76:7\n #2 0x4f6c08 in boom_intermediate() v8/test/fuzzer/wasm-code.cc:83:14\n #3 0x4f6c38 in boom() v8/test/fuzzer/wasm-code.cc:87:7\n #4 0x4f6cd3 in LLVMFuzzerTestOneInput v8/test/fuzzer/wasm-code.cc:100:6\n #5 0x5125bd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:550:13\n #6 0x512aeb in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:501:3\n #7 0x4f7997 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:268:6\n #8 0x4faa80 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:517:9\n #9 0x51a108 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10\n #10 0x7fc7047d7f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ILL () \n==89063==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_invalid_free.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_invalid_free.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_invalid_free.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_invalid_free.txt.snap index f13b6a7014..b412ebb916 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_invalid_free.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_invalid_free.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_invalid_free.txt +--- { "text": "==1==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x00000a5742f0 in thread T0\nSCARINESS: 40 (bad-free)\n #0 0x420510 in __interceptor_cfree.localalias.0 /src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:54\n #1 0x477d65 in _gnutls_buffer_append_printf /src/gnutls/lib/str.c:331:2\n #2 0x461045 in print_cert /src/gnutls/lib/x509/output.c:1398:4\n #3 0x45eee9 in gnutls_x509_crt_print /src/gnutls/lib/x509/output.c:1905:3\n #4 0x45e3ec in LLVMFuzzerTestOneInput /src/gnutls/devel/fuzz/gnutls_x509_parser_fuzzer.cc:40:15\n #5 0x949308 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:546:13\n #6 0x94a064 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:497:3\n #7 0x8d6e87 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:267:6\n #8 0x8df0bd in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:486:9\n #9 0x8d52e8 in main /src/libfuzzer/FuzzerMain.cpp:20:10\n #10 0x7fabc7bb482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\n #11 0x368028 in _start (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_gnutls_7679aa0e59b24ed63ab362aea60b8fc3a34a955a/revisions/gnutls_x509_parser_fuzzer+0x368028)\nAddress 0x00000a5742f0 is a wild pointer.\nSUMMARY: AddressSanitizer: bad-free /src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:54 in __interceptor_cfree.localalias.0\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_read.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_read.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_read.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_read.txt.snap index e7588c1f0b..4843dce7a8 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_read.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_read.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_null_dereference_read.txt +--- { "text": "ASAN:DEADLYSIGNAL\n=================================================================\n==1550==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7efef5995c27 bp 0x7fff15768f00 sp 0x7fff15768ef0 T0)\n==1550==The signal is caused by a READ memory access.\n==1550==Hint: address points to the zero page.\n #0 0x7efef5995c26 in operator-> buildtools/third_party/libc++/trunk/include/memory:2713:76\n #1 0x7efef5995c26 in content::NavigationEntryImpl::site_instance() const content/browser/frame_host/navigation_entry_impl.h:224\n #2 0x7efef599dd1b in content::NavigationControllerImpl::ClassifyNavigation(content::RenderFrameHostImpl*, FrameHostMsg_DidCommitProvisionalLoad_Params const&) const content/browser/frame_host/navigation_controller_impl.cc:1058:9\n #3 0x7efef599c379 in content::NavigationControllerImpl::RendererDidNavigate(content::RenderFrameHostImpl*, FrameHostMsg_DidCommitProvisionalLoad_Params const&, content::LoadCommittedDetails*) content/browser/frame_host/navigation_controller_impl.cc:866:19\n #4 0x7efef653f020 in content::NavigatorImpl::DidNavigate(content::RenderFrameHostImpl*, FrameHostMsg_DidCommitProvisionalLoad_Params const&) content/browser/frame_host/navigator_impl.cc:523:23\n #5 0x7efef59d6b5f in content::RenderFrameHostImpl::OnDidCommitProvisionalLoad(IPC::Message const&) content/browser/frame_host/render_frame_host_impl.cc:1083:3\n #6 0x7efef59d181c in content::RenderFrameHostImpl::OnMessageReceived(IPC::Message const&) content/browser/frame_host/render_frame_host_impl.cc:521:5\n #7 0x7efef5c4cffa in content::RenderProcessHostImpl::OnMessageReceived(IPC::Message const&) content/browser/renderer_host/render_process_host_impl.cc:1803:10\n #8 0x7efeeecf10ac in IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const&) ipc/ipc_channel_proxy.cc:293:3\n #9 0x7efeeecf793d in void base::internal::InvokeHelper >::MakeItSo(base::internal::RunnableAdapter, IPC::ChannelProxy::Context*&&, IPC::Message const&) base/bind_internal.h:301:5\n #10 0x7efeeecf77b4 in base::internal::Invoker, base::internal::BindState, void (IPC::ChannelProxy::Context*, IPC::Message const&), IPC::ChannelProxy::Context*, IPC::Message const&>, base::internal::InvokeHelper >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:352:12\n #11 0x7efeec743177 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #12 0x7efeec5b4b08 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:476:3\n #13 0x7efeec5b589d in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:485:5\n #14 0x7efeec5b5f42 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:597:13\n #15 0x7efeec73ae86 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:313:31\n #16 0x7efeec5b4054 in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #17 0x7efeec621e24 in base::RunLoop::Run() base/run_loop.cc:35:3\n #18 0x7efeebb7f6eb in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #19 0x7efef631f8b0 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:958:21\n #20 0x7efef58ab50f in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #21 0x7efef58a998c in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #22 0x7efeec45690a in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:398:14\n #23 0x7efeec459f7f in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:769:12\n #24 0x7efeec45401d in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #25 0x7efeeb09b0cc in ChromeMain chrome/app/chrome_main.cc:84:12\n #26 0x7efee03d1ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-asan_linux-release_4392242b7f59878a2775b4607420a2b37e17ff13/symbolized/release/asan-symbolized-linux-release-381276/chrome+0xd602c26)\n==1550==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_unknown.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_unknown.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_unknown.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_unknown.txt.snap index e956f068c9..391d8ec852 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_unknown.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_unknown.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_null_dereference_unknown.txt +--- { "text": "ASAN:DEADLYSIGNAL\n=================================================================\n==1550==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000530 (pc 0x7efef5995c27 bp 0x7fff15768f00 sp 0x7fff15768ef0 T0)\n==1550==The signal is caused by a UNKNOWN memory access.\n==1550==Hint: address points to the zero page.\n #0 0x7fda4ecc3242 in blink::Member::get() const third_party/WebKit/Source/platform/heap/Handle.h:824:29\n #1 0x7fda4ecc00d1 in blink::Document::styleEngine() third_party/WebKit/Source/core/dom/Document.h:385:71\n #2 0x7fda4fef7e5c in blink::Document::updateLayoutTreeIgnorePendingStylesheets() third_party/WebKit/Source/core/dom/Document.cpp:1990:53\n #3 0x7fda4fef825e in blink::Document::updateLayoutIgnorePendingStylesheets(blink::Document::RunPostLayoutTasks) third_party/WebKit/Source/core/dom/Document.cpp:2018:5\n #4 0x7fda50b99186 in blink::TextIteratorAlgorithm >::TextIteratorAlgorithm(blink::PositionTemplate > const&, blink::PositionTemplate > const&, unsigned int) third_party/WebKit/Source/core/editing/iterators/TextIterator.cpp:150:5\n #5 0x7fda50ba0f82 in blink::TextIteratorAlgorithm >::rangeLength(blink::PositionTemplate > const&, blink::PositionTemplate > const&, bool) third_party/WebKit/Source/core/editing/iterators/TextIterator.cpp:1096:42\n #6 0x7fda50bfea62 in blink::TextCheckingParagraph::checkingStart() const third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp:206:27\n #7 0x7fda50bfe68b in blink::TextCheckingParagraph::isRangeEmpty() const third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.h:73:40\n #8 0x7fda50bfe5fa in blink::TextCheckingParagraph::isEmpty() const third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp:182:12\n #9 0x7fda50bf5aa6 in blink::SpellChecker::chunkAndMarkAllMisspellingsAndBadGrammar(unsigned int, blink::TextCheckingParagraph const&) third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp:512:9\n #10 0x7fda50bf47d0 in blink::SpellChecker::markAllMisspellingsAndBadGrammarInRanges(unsigned int, blink::EphemeralRangeTemplate > const&, blink::EphemeralRangeTemplate > const&) third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp:479:5\n #11 0x7fda50bf3e6d in blink::SpellChecker::markMisspellingsAndBadGrammar(blink::VisibleSelectionTemplate > const&, bool, blink::VisibleSelectionTemplate > const&) third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp:640:9\n #12 0x7fda50bf1826 in blink::SpellChecker::didBeginEditing(blink::Element*) third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp:147:13\n #13 0x7fda4ff10813 in blink::Document::setFocusedElement(WTF::RawPtr, blink::FocusParams const&) third_party/WebKit/Source/core/dom/Document.cpp:3673:13\n #14 0x7fda5115d229 in blink::FocusController::setFocusedElement(blink::Element*, WTF::RawPtr, blink::FocusParams const&) third_party/WebKit/Source/core/page/FocusController.cpp:912:36\n #15 0x7fda5115ca98 in blink::FocusController::setFocusedElement(blink::Element*, WTF::RawPtr) third_party/WebKit/Source/core/page/FocusController.cpp:869:12\n #16 0x7fda50a72023 in blink::FrameSelection::setFocusedNodeIfNeeded() third_party/WebKit/Source/core/editing/FrameSelection.cpp:1112:17\n #17 0x7fda50a677cc in void blink::FrameSelection::setSelectionAlgorithm >(blink::VisibleSelectionTemplate > const&, unsigned int, blink::CursorAlignOnScroll, blink::TextGranularity) third_party/WebKit/Source/core/editing/FrameSelection.cpp:331:9\n #18 0x7fda50a6fa9a in blink::FrameSelection::selectAll() third_party/WebKit/Source/core/editing/FrameSelection.cpp:864:5\n #19 0x7fda50b48cb2 in blink::executeSelectAll(blink::LocalFrame&, blink::Event*, blink::EditorCommandSource, WTF::String const&) third_party/WebKit/Source/core/editing/commands/EditorCommand.cpp:1070:5\n #20 0x7fda50b41c8e in blink::Editor::Command::execute(WTF::String const&, blink::Event*) const third_party/WebKit/Source/core/editing/commands/EditorCommand.cpp:1792:12\n #21 0x7fda4ff1d5a3 in blink::Document::execCommand(WTF::String const&, bool, WTF::String const&, blink::ExceptionState&) third_party/WebKit/Source/core/dom/Document.cpp:4470:12\n #22 0x7fda523162d7 in blink::DocumentV8Internal::execCommandMethod(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8Document.cpp:4682:19\n #23 0x7fda5230c9b6 in blink::DocumentV8Internal::execCommandMethodCallback(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8Document.cpp:4693:5\n #24 0x7fda4e73f6f1 in v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo const&)) v8/src/arguments.cc:33:3\n #25 0x7fda4dac0e26 in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>) v8/src/builtins.cc:3671:34\n #26 0x7fda4db18613 in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>, v8::internal::Isolate*) v8/src/builtins.cc:3695:3\n #27 0x7fda4dac898a in v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) v8/src/builtins.cc:3692:1\n #28 0x7fd88a3089da ()\n #29 0x7fd88a406df3 ()\n #30 0x7fd88a3384a3 ()\n #31 0x7fd88a319da1 ()\n #28 0x7fda4df1633f in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle) v8/src/execution.cc:97:13\n #29 0x7fda4df1566c in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:163:10\n #30 0x7fda4d9c88c3 in v8::Script::Run(v8::Local) v8/src/api.cc:1717:23\n #31 0x7fda51ef234f in blink::V8ScriptRunner::runCompiledScript(v8::Isolate*, v8::Local, blink::ExecutionContext*) third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp:417:18\n #32 0x7fda51e31d16 in blink::ScriptController::executeScriptAndReturnValue(v8::Local, blink::ScriptSourceCode const&, blink::AccessControlStatus, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:192:21\n #33 0x7fda51e3661d in blink::ScriptController::evaluateScriptInMainWorld(blink::ScriptSourceCode const&, blink::AccessControlStatus, blink::ScriptController::ExecuteScriptPolicy, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:571:35\n #34 0x7fda51e36b97 in blink::ScriptController::executeScriptInMainWorld(blink::ScriptSourceCode const&, blink::AccessControlStatus, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:544:5\n #35 0x7fda502be0f6 in blink::ScriptLoader::executeScript(blink::ScriptSourceCode const&, double*) third_party/WebKit/Source/core/dom/ScriptLoader.cpp:431:5\n #36 0x7fda502ba357 in blink::ScriptLoader::prepareScript(WTF::TextPosition const&, blink::ScriptLoader::LegacyTypeSupport) third_party/WebKit/Source/core/dom/ScriptLoader.cpp:280:14\n #37 0x7fda50567e90 in blink::HTMLScriptRunner::runScript(blink::Element*, WTF::TextPosition const&) third_party/WebKit/Source/core/html/parser/HTMLScriptRunner.cpp:427:9\n #38 0x7fda505678e2 in blink::HTMLScriptRunner::execute(WTF::RawPtr, WTF::TextPosition const&) third_party/WebKit/Source/core/html/parser/HTMLScriptRunner.cpp:283:5\n #39 0x7fda50525c1b in blink::HTMLDocumentParser::runScriptsForPausedTreeBuilder() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:330:9\n #40 0x7fda50529774 in blink::HTMLDocumentParser::processParsedChunkFromBackgroundParser(WTF::PassOwnPtr) third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:525:13\n #41 0x7fda505252fe in blink::HTMLDocumentParser::pumpPendingSpeculations() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:586:36\n #42 0x7fda50524ea5 in blink::HTMLDocumentParser::resumeParsingAfterYield() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:319:5\n #43 0x7fda5054f1f2 in WTF::FunctionWrapper::operator()(WTF::WeakPtr const&) third_party/WebKit/Source/wtf/Functional.h:99:16\n #44 0x7fda5054eb3b in WTF::PartBoundFunctionImpl<1, WTF::FunctionWrapper, void (blink::CrossThreadWeakPersistentThisPointer)>::operator()() third_party/WebKit/Source/wtf/Functional.h:182:16\n #45 0x7fda5aefa5e4 in blink::CancellableTaskFactory::CancellableTask::run() third_party/WebKit/Source/platform/scheduler/CancellableTaskFactory.cpp:28:9\n #46 0x7fda55fa9f3e in base::internal::RunnableAdapter >)>::Run(scoped_ptr >) base/bind_internal.h:158:12\n #47 0x7fda55fa9d67 in base::internal::InvokeHelper >)>, base::internal::TypeList > > >::MakeItSo(base::internal::RunnableAdapter >)>, scoped_ptr >) base/bind_internal.h:298:5\n #48 0x7fda55fa9c03 in base::internal::Invoker, base::internal::BindState >)>, void (scoped_ptr >), base::internal::PassedWrapper > > >, base::internal::TypeList > > > >, base::internal::InvokeHelper >)>, base::internal::TypeList > > >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:348:12\n #49 0x7fda49e2dac7 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #50 0x7fda55fc870d in scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(scheduler::internal::WorkQueue*, scheduler::internal::TaskQueueImpl::Task*) components/scheduler/base/task_queue_manager.cc:286:3\n #51 0x7fda55fc517e in scheduler::TaskQueueManager::DoWork(base::TimeTicks, bool) components/scheduler/base/task_queue_manager.cc:198:13\n #52 0x7fda55fcbf9a in base::internal::InvokeHelper, base::internal::TypeList const&, base::TimeTicks const&, bool const&> >::MakeItSo(base::internal::RunnableAdapter, base::WeakPtr const&, base::TimeTicks const&, bool const&) base/bind_internal.h:308:5\n #53 0x7fda49e2dac7 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #54 0x7fda49c94119 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:486:3\n #55 0x7fda49c94ead in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:495:5\n #56 0x7fda49c95542 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:607:13\n #57 0x7fda49ca3b79 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:33:21\n #58 0x7fda49c935f5 in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:450:3\n #59 0x7fda49d02c94 in base::RunLoop::Run() base/run_loop.cc:56:3\n #60 0x7fda49c90e28 in base::MessageLoop::Run() base/message_loop/message_loop.cc:293:3\n #61 0x7fda56132666 in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:226:7\n #62 0x7fda49b2e308 in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:294:14\n #63 0x7fda49b2ff32 in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:381:12\n #64 0x7fda49b332a1 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:742:12\n #65 0x7fda49b2d051 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #66 0x7fda48721d59 in ChromeMain chrome/app/chrome_main.cc:67:12\n #67 0x7fda3dc1fec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-release_3e8ee0f0e660f39ebe723667101aab55a53e781c/symbolized/release/asan-symbolized-linux-release-v8-component-33791/chrome+0x90a7242)\n==1==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_win_read.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_win_read.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_win_read.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_win_read.txt.snap index c6069c997a..b604c3cb3f 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_win_read.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_win_read.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_null_dereference_win_read.txt +--- { "text": "=================================================================\n==3316==ERROR: AddressSanitizer: access-violation on unknown address 0x00000008 (pc 0x59565ab9 bp 0x001ad27c sp 0x001ad000 T0)\n==3316==The signal is caused by a READ memory access.\n==3316==Hint: address points to the zero page.\nSCARINESS: 10 (null-deref)\n==3316==*** WARNING: Failed to initialize DbgHelp! ***\n==3316==*** Most likely this means that the app is already ***\n==3316==*** using DbgHelp, possibly with incompatible flags. ***\n==3316==*** Due to technical reasons, symbolization might crash ***\n==3316==*** or produce wrong results. ***\n==3316==WARNING: Failed to use and restart external symbolizer!\n #0 0x59565ab8 in blink::SVGEnumerationBase::calculateAnimatedValue third_party/WebKit/Source/core/svg/SVGEnumeration.cpp:90\n #1 0x594c249e in blink::SVGAnimateElement::calculateAnimatedValue third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp:378\n #2 0x594748c6 in blink::SVGAnimationElement::updateAnimation third_party/WebKit/Source/core/svg/SVGAnimationElement.cpp:617\n #3 0x59556967 in blink::SMILTimeContainer::updateAnimations third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp:485\n #4 0x595588d9 in blink::SMILTimeContainer::updateAnimationsAndScheduleFrameIfNeeded third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp:414\n #5 0x5955490c in blink::SMILTimeContainer::wakeupTimerFired third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp:289\n #6 0x58afdd31 in blink::TaskRunnerTimer::fired third_party/WebKit/Source/platform/Timer.h:144\n #7 0x56fb5842 in blink::TimerBase::runInternal third_party/WebKit/Source/platform/Timer.cpp:174\n #8 0x54876038 in base::debug::TaskAnnotator::RunTask base/debug/task_annotator.cc:57\n #9 0x5718efce in blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:533\n #10 0x5718a666 in blink::scheduler::TaskQueueManager::DoWork third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:331\n #11 0x5a99ba44 in base::internal::Invoker,bool>,void ()>::Run base/bind_internal.h:340\n #12 0x54876038 in base::debug::TaskAnnotator::RunTask base/debug/task_annotator.cc:57\n #13 0x5471fa1f in base::MessageLoop::RunTask base/message_loop/message_loop.cc:423\n #14 0x547208d6 in base::MessageLoop::DeferOrRunPendingTask base/message_loop/message_loop.cc:434\n #15 0x54721bf6 in base::MessageLoop::DoWork base/message_loop/message_loop.cc:527\n #16 0x5487c3ba in base::MessagePumpDefault::Run base/message_loop/message_pump_default.cc:33\n #17 0x5471ea59 in base::MessageLoop::RunHandler base/message_loop/message_loop.cc:387\n #18 0x547a0efd in base::RunLoop::Run base/run_loop.cc:37\n #19 0x5a853a26 in content::RendererMain content/renderer/renderer_main.cc:200\n #20 0x545a0015 in content::RunNamedProcessTypeMain content/app/content_main_runner.cc:491\n #21 0x545a13da in content::ContentMainRunnerImpl::Run content/app/content_main_runner.cc:836\n #22 0x5459fc00 in content::ContentMain content/app/content_main.cc:20\n #23 0x514a11c2 in ChromeMain chrome/app/chrome_main.cc:121\n #24 0x9a97d9 in MainDllLoader::Launch chrome/app/main_dll_loader_win.cc:201\n #25 0x9a1926 in main chrome/app/chrome_exe_main_win.cc:271\n #26 0xbe26ba in __scrt_common_main_seh f:\\dd\\vctools\\crt\\vcstartup\\src\\startup\\exe_common.inl:253\n #27 0x76837c03 in BaseThreadInitThunk+0x23 (C:\\windows\\SYSTEM32\\KERNEL32.DLL+0x17c03)\n #28 0x7712ab8e in RtlInitializeExceptionChain+0x8e (C:\\windows\\SYSTEM32\\ntdll.dll+0x5ab8e)\n #29 0x7712ab59 in RtlInitializeExceptionChain+0x59 (C:\\windows\\SYSTEM32\\ntdll.dll+0x5ab59)\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: access-violation third_party\\WebKit\\Source\\core\\svg\\SVGEnumeration.cpp:90 in blink::SVGEnumerationBase::calculateAnimatedValue\n==3316==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_win_write.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_win_write.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_win_write.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_win_write.txt.snap index c4ac35b203..9afaed2374 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_win_write.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_win_write.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_null_dereference_win_write.txt +--- { "text": "=================================================================\n==3316==ERROR: AddressSanitizer: access-violation on unknown address 0x00000008 (pc 0x59565ab9 bp 0x001ad27c sp 0x001ad000 T0)\n==3316==The signal is caused by a WRITE memory access.\n==3316==Hint: address points to the zero page.\nSCARINESS: 10 (null-deref)\n==3316==*** WARNING: Failed to initialize DbgHelp! ***\n==3316==*** Most likely this means that the app is already ***\n==3316==*** using DbgHelp, possibly with incompatible flags. ***\n==3316==*** Due to technical reasons, symbolization might crash ***\n==3316==*** or produce wrong results. ***\n==3316==WARNING: Failed to use and restart external symbolizer!\n #0 0x59565ab8 in blink::SVGEnumerationBase::calculateAnimatedValue third_party/WebKit/Source/core/svg/SVGEnumeration.cpp:90\n #1 0x594c249e in blink::SVGAnimateElement::calculateAnimatedValue third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp:378\n #2 0x594748c6 in blink::SVGAnimationElement::updateAnimation third_party/WebKit/Source/core/svg/SVGAnimationElement.cpp:617\n #3 0x59556967 in blink::SMILTimeContainer::updateAnimations third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp:485\n #4 0x595588d9 in blink::SMILTimeContainer::updateAnimationsAndScheduleFrameIfNeeded third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp:414\n #5 0x5955490c in blink::SMILTimeContainer::wakeupTimerFired third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp:289\n #6 0x58afdd31 in blink::TaskRunnerTimer::fired third_party/WebKit/Source/platform/Timer.h:144\n #7 0x56fb5842 in blink::TimerBase::runInternal third_party/WebKit/Source/platform/Timer.cpp:174\n #8 0x54876038 in base::debug::TaskAnnotator::RunTask base/debug/task_annotator.cc:57\n #9 0x5718efce in blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:533\n #10 0x5718a666 in blink::scheduler::TaskQueueManager::DoWork third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:331\n #11 0x5a99ba44 in base::internal::Invoker,bool>,void ()>::Run base/bind_internal.h:340\n #12 0x54876038 in base::debug::TaskAnnotator::RunTask base/debug/task_annotator.cc:57\n #13 0x5471fa1f in base::MessageLoop::RunTask base/message_loop/message_loop.cc:423\n #14 0x547208d6 in base::MessageLoop::DeferOrRunPendingTask base/message_loop/message_loop.cc:434\n #15 0x54721bf6 in base::MessageLoop::DoWork base/message_loop/message_loop.cc:527\n #16 0x5487c3ba in base::MessagePumpDefault::Run base/message_loop/message_pump_default.cc:33\n #17 0x5471ea59 in base::MessageLoop::RunHandler base/message_loop/message_loop.cc:387\n #18 0x547a0efd in base::RunLoop::Run base/run_loop.cc:37\n #19 0x5a853a26 in content::RendererMain content/renderer/renderer_main.cc:200\n #20 0x545a0015 in content::RunNamedProcessTypeMain content/app/content_main_runner.cc:491\n #21 0x545a13da in content::ContentMainRunnerImpl::Run content/app/content_main_runner.cc:836\n #22 0x5459fc00 in content::ContentMain content/app/content_main.cc:20\n #23 0x514a11c2 in ChromeMain chrome/app/chrome_main.cc:121\n #24 0x9a97d9 in MainDllLoader::Launch chrome/app/main_dll_loader_win.cc:201\n #25 0x9a1926 in main chrome/app/chrome_exe_main_win.cc:271\n #26 0xbe26ba in __scrt_common_main_seh f:\\dd\\vctools\\crt\\vcstartup\\src\\startup\\exe_common.inl:253\n #27 0x76837c03 in BaseThreadInitThunk+0x23 (C:\\windows\\SYSTEM32\\KERNEL32.DLL+0x17c03)\n #28 0x7712ab8e in RtlInitializeExceptionChain+0x8e (C:\\windows\\SYSTEM32\\ntdll.dll+0x5ab8e)\n #29 0x7712ab59 in RtlInitializeExceptionChain+0x59 (C:\\windows\\SYSTEM32\\ntdll.dll+0x5ab59)\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: access-violation third_party\\WebKit\\Source\\core\\svg\\SVGEnumeration.cpp:90 in blink::SVGEnumerationBase::calculateAnimatedValue\n==3316==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_write.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_write.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_write.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_write.txt.snap index 3addf4c3d6..95b96a5bcd 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_null_dereference_write.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_null_dereference_write.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_null_dereference_write.txt +--- { "text": "ASAN:DEADLYSIGNAL\n=================================================================\n==29409==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000178 (pc 0x7f5eae7977d1 bp 0x7ffcc670d840 sp 0x7ffcc670cfd8 T0)\n==29409==The signal is caused by a WRITE memory access.\n==29409==Hint: address points to the zero page.\n #0 0x7f5eae7977d0 in memcpy-ssse3-back.S:1702 /build/eglibc-rrybNj/eglibc-2.15/sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:1702\n #1 0x7f5eba8358a1 in SetTaskInfo base/timer/timer.cc:145:16\n #2 0x7f5eba8358a1 in base::Timer::Start(tracked_objects::Location const&, base::TimeDelta, base::Callback const&) base/timer/timer.cc:105\n #3 0x7f5eca365821 in Start base/timer/timer.h:224:5\n #4 0x7f5eca365821 in StartCancelAllTimer ui/views/controls/menu/menu_controller.cc:1832\n #5 0x7f5eca365821 in views::MenuController::OnDragExited(views::SubmenuView*) ui/views/controls/menu/menu_controller.cc:925\n #6 0x7f5eca59bd42 in NotifyDragExit ui/views/widget/drop_helper.cc:154:5\n #7 0x7f5eca59bd42 in views::DropHelper::OnDragExit() ui/views/widget/drop_helper.cc:47\n #8 0x7f5eca5c18f0 in NotifyDragLeave ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc:1019:5\n #9 0x7f5eca5c18f0 in views::DesktopDragDropClientAuraX11::~DesktopDragDropClientAuraX11() ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc:447\n #10 0x7f5eca5c1f0a in views::DesktopDragDropClientAuraX11::~DesktopDragDropClientAuraX11() ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc:443:63\n #11 0x7f5eca52b660 in operator() buildtools/third_party/libc++/trunk/include/memory:2529:13\n #12 0x7f5eca52b660 in reset buildtools/third_party/libc++/trunk/include/memory:2735\n #13 0x7f5eca52b660 in views::DesktopNativeWidgetAura::OnDesktopWindowTreeHostDestroyed(aura::WindowTreeHost*) ui/views/widget/desktop_aura/desktop_native_widget_aura.cc:355\n #14 0x7f5eca5438d9 in views::DesktopWindowTreeHostX11::~DesktopWindowTreeHostX11() ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc:184:3\n #15 0x7f5eca543f3e in ~DesktopWindowTreeHostX11 ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc:181:55\n #16 0x7f5eca543f3e in non-virtual thunk to views::DesktopWindowTreeHostX11::~DesktopWindowTreeHostX11() ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc:181\n #17 0x7f5eca52b012 in operator() buildtools/third_party/libc++/trunk/include/memory:2529:13\n #18 0x7f5eca52b012 in reset buildtools/third_party/libc++/trunk/include/memory:2735\n #19 0x7f5eca52b012 in views::DesktopNativeWidgetAura::OnHostClosed() ui/views/widget/desktop_aura/desktop_native_widget_aura.cc:330\n #20 0x7f5eca54d397 in views::DesktopWindowTreeHostX11::CloseNow() ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc:392:3\n #21 0x7f5eca567bdf in Run<> base/bind_internal.h:181:12\n #22 0x7f5eca567bdf in MakeItSo> base/bind_internal.h:314\n #23 0x7f5eca567bdf in base::internal::Invoker, base::internal::BindState, void (views::DesktopWindowTreeHostX11*), base::WeakPtr >, base::internal::InvokeHelper >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:351\n #24 0x7f5eba8c5fe9 in Run base/callback.h:394:12\n #25 0x7f5eba8c5fe9 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51\n #26 0x7f5eba6fc007 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:476:3\n #27 0x7f5eba6fd05b in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:485:5\n #28 0x7f5eba6fdd7a in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:597:13\n #29 0x7f5eba8be1d7 in HandleDispatch base/message_loop/message_pump_glib.cc:267:7\n #30 0x7f5eba8be1d7 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:109\n #31 0x7f5eb5767d12 in g_main_dispatch /build/buildd/glib2.0-2.32.4/glib/gmain.c:2539\n #32 0x7f5eb5767d12 in g_main_context_dispatch /build/buildd/glib2.0-2.32.4/glib/gmain.c:3075\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x14e7d0)\n==29409==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_stack_overflow.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_stack_overflow.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_stack_overflow.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_stack_overflow.txt.snap index 11b8ea2408..df83057743 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_stack_overflow.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_stack_overflow.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_stack_overflow.txt +--- { "text": "Rendering PDF file /home/user/git/clusterfuzz/local/clusterfuzz/bot/inputs/fuzzer-testcases/signal_sigbus_5013e7_3250_half-year-report-2007.pdf.\nNon-linearized path...\nASAN:SIGSEGV\n=================================================================\n==24828==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc533cef30 (pc 0x0000004cf88e bp 0x7ffc533cf770 sp 0x7ffc533cef20 T0)\n #0 0x4cf88d in operator new(unsigned long)\n #1 0x86fbe2 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1160:15\n #2 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #3 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #4 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #5 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #6 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #7 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #8 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #9 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #10 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #11 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #12 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #13 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #14 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #15 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #16 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #17 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #18 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #19 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #20 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #21 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #22 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #23 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #24 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #25 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #26 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #27 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #28 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #29 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #30 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #31 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #32 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #33 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #34 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #35 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #36 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #37 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #38 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #39 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #40 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #41 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #42 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #43 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #44 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #45 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #46 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #47 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #48 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #49 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #50 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #51 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #52 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #53 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #54 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #55 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #56 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #57 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #58 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #59 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #60 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #61 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #62 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #63 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #64 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #65 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #66 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #67 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #68 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #69 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #70 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #71 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #72 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #73 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #74 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #75 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #76 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #77 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #78 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #79 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #80 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #81 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #82 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #83 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #84 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #85 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #86 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #87 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #88 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #89 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #90 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #91 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #92 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #93 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #94 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #95 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #96 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #97 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #98 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #99 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #100 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #101 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #102 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #103 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #104 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #105 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #106 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #107 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #108 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #109 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #110 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #111 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #112 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #113 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #114 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #115 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #116 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #117 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #118 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #119 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #120 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #121 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #122 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #123 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #124 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #125 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #126 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #127 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #128 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #129 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #130 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #131 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #132 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #133 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #134 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #135 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #136 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #137 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #138 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #139 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #140 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #141 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #142 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #143 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #144 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #145 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #146 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #147 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #148 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #149 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #150 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #151 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #152 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #153 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #154 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #155 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #156 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #157 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #158 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #159 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #160 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #161 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #162 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #163 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #164 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #165 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #166 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #167 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #168 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #169 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #170 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #171 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #172 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #173 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #174 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #175 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #176 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #177 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #178 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #179 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #180 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #181 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #182 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #183 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #184 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #185 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #186 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #187 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #188 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #189 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #190 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #191 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #192 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #193 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #194 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #195 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #196 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #197 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #198 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #199 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #200 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #201 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #202 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #203 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #204 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #205 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #206 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #207 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #208 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #209 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #210 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #211 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #212 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #213 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #214 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #215 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #216 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #217 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #218 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #219 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #220 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #221 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #222 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #223 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #224 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #225 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #226 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #227 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #228 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #229 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #230 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #231 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #232 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #233 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #234 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #235 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #236 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #237 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #238 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #239 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #240 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #241 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #242 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #243 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #244 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #245 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #246 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #247 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #248 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #249 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #250 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n #251 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #252 0x87c7d8 in CPDF_DocPageData::GetColorSpace(CPDF_Object*, CPDF_Dictionary*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_doc.cpp:391:28\n #253 0x872927 in CPDF_IndexedCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:801:17\n #254 0x86fd58 in CPDF_ColorSpace::Load(CPDF_Document*, CPDF_Object*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1167:10\n #255 0x875bbe in CPDF_DeviceNCS::v_Load(CPDF_Document*, CPDF_Array*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/third_party/pdfium/core/src/fpdfapi/fpdf_page/fpdf_page_colors.cpp:1052:16\n\nSUMMARY: AddressSanitizer: stack-overflow (/home/user/git/clusterfuzz/local/clusterfuzz/bot/builds/pdfium_test/custom/asan-symbolized-linux-release-current/pdfium_test+0x4cf88d)\n==24828==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_stack_overflow2.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_stack_overflow2.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_stack_overflow2.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_stack_overflow2.txt.snap index 72cc861e13..24091749d9 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_stack_overflow2.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_stack_overflow2.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_stack_overflow2.txt +--- { "text": "==1==ERROR: AddressSanitizer: stack-overflow on address 0x7ffca4df4b38 (pc 0x000000467236 bp 0x7ffca4df53b0 sp 0x7ffca4df4b40 T0)\nSCARINESS: 10 (stack-overflow)\n#0 0x467235 in __interceptor_memcpy.part.35 /src/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc:649\n#1 0x57cec2 in fuzzer::TracePC::AddValueForMemcmp(void*, void const*, void const*, unsigned long, bool) /src/libfuzzer/FuzzerTracePC.cpp:256:11\n#2 0x4b1435 in __interceptor_memcmp.part.75 /src/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc:706\n#3 0x5d985e in grpc_is_binary_header /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/lib/surface/validate_metadata.c:103:15\n#4 0x65f459 in is_binary_literal_header /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1542:10\n#5 0x65f0aa in parse_value_string_with_literal_key /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1582:52\n#6 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#7 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#8 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#9 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#10 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#11 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#12 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#13 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#14 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#15 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#16 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#17 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#18 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#19 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#20 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#21 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#22 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#23 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#24 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#25 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#26 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#27 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#28 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#29 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#30 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#31 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#32 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#33 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#34 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#35 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#36 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#37 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#38 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#39 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#40 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#41 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#42 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#43 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#44 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#45 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#46 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#47 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#48 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#49 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#50 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#51 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#52 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#53 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#54 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#55 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#56 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#57 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#58 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#59 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#60 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#61 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#62 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#63 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#64 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#65 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#66 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#67 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#68 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#69 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#70 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#71 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#72 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#73 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#74 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#75 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#76 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#77 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#78 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#79 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#80 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#81 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#82 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#83 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#84 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#85 0x65fbdb in finish_lithdr_nvridx /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1000:10\n#86 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#87 0x65c7ba in parse_value_string_with_indexed_key /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1576:10\n#88 0x65fbdb in finish_lithdr_nvridx /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1000:10\n#89 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#90 0x65c7ba in parse_value_string_with_indexed_key /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1576:10\n#91 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#92 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#93 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#94 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#95 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#96 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#97 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#98 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#99 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#100 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#101 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#102 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#103 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#104 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#105 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#106 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#107 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#108 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#109 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#110 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#111 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#112 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#113 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#114 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#115 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#116 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#117 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#118 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#119 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#120 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#121 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#122 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#123 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#124 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#125 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#126 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#127 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#128 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#129 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#130 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#131 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#132 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#133 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#134 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#135 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#136 0x65ca41 in finish_lithdr_incidx /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:860:10\n#137 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#138 0x65c7ba in parse_value_string_with_indexed_key /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1576:10\n#139 0x65fbdb in finish_lithdr_nvridx /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1000:10\n#140 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#141 0x65c7ba in parse_value_string_with_indexed_key /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1576:10\n#142 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#143 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#144 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#145 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#146 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#147 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#148 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#149 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#150 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#151 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#152 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#153 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#154 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#155 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#156 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#157 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#158 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#159 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#160 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#161 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#162 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#163 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#164 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#165 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#166 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#167 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#168 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#169 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#170 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#171 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#172 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#173 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#174 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#175 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#176 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#177 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#178 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#179 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#180 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#181 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#182 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#183 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#184 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#185 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#186 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#187 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#188 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#189 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#190 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#191 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#192 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#193 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#194 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#195 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#196 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#197 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#198 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#199 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#200 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#201 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#202 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#203 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#204 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#205 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#206 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#207 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#208 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#209 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#210 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#211 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#212 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#213 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#214 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#215 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#216 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#217 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#218 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#219 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#220 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#221 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#222 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#223 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#224 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#225 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#226 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#227 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#228 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#229 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#230 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#231 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#232 0x65fbdb in finish_lithdr_nvridx /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1000:10\n#233 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#234 0x65c7ba in parse_value_string_with_indexed_key /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1576:10\n#235 0x65fbdb in finish_lithdr_nvridx /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1000:10\n#236 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#237 0x65c7ba in parse_value_string_with_indexed_key /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1576:10\n#238 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#239 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#240 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#241 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#242 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#243 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#244 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#245 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#246 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#247 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#248 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#249 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#250 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\nSUMMARY: AddressSanitizer: stack-overflow (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_grpc_d0794529694787333c473247f188e97858564039/revisions/hpack_parser_fuzzer_test+0x467235)\n==1==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_stack_overflow3.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_stack_overflow3.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_stack_overflow3.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_stack_overflow3.txt.snap index f5caf0fd03..657cd93499 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_stack_overflow3.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_stack_overflow3.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_stack_overflow3.txt +--- { "text": "==1==ERROR: AddressSanitizer: stack-overflow on address 0x7ffca4df4b38 (pc 0x000000467236 bp 0x7ffca4df53b0 sp 0x7ffca4df4b40 T0)\nSCARINESS: 10 (stack-overflow)\n#0 0x467235 in __interceptor_memcpy.part.35 /src/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc:649\n#1 0x57cec2 in fuzzer::TracePC::AddValueForMemcmp(void*, void const*, void const*, unsigned long, bool) /src/libfuzzer/FuzzerTracePC.cpp:256:11\n#2 0x4b1435 in __interceptor_memcmp.part.75 /src/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc:706\n#3 0x5d985e in grpc_is_binary_header /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/lib/surface/validate_metadata.c:103:15\n#4 0x65f459 in is_binary_literal_header /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1542:10\n#5 0x65f0aa in parse_value_string_with_literal_key /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1582:52\n#6 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#7 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#8 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#9 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#10 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#11 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#12 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#13 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#14 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#15 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#16 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#17 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#18 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#19 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#20 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#21 0x65d185 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1521:12\n#22 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n#23 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#24 0x65d273 in begin_parse_string /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:1529:10\n#25 0x65f969 in finish_lithdr_notidx_v /home/builder/.cache/bazel/_bazel_builder/ec9ee79d770c6b7183036e592ac23980/execroot/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.c:944:10\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_uaf.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_uaf.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_uaf.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_uaf.txt.snap index 7e20e3b6e8..b13e8d5188 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_uaf.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_uaf.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_uaf.txt +--- { "text": "==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f00003b280 at pc 0x7efd4a2a3e03 bp 0x7ffd1ed50680 sp 0x7ffd1ed50678\nREAD of size 8 at 0x60f00003b280 thread T0 (chrome)\n #0 0x7efd4a2a3e02 in WTF::RawPtr::operator*() const third_party/WebKit/Source/wtf/RawPtr.h:118:36\n #1 0x7efd4a29f60e in blink::InputTypeView::element() const third_party/WebKit/Source/core/html/forms/InputTypeView.h:129:48\n #2 0x7efd4a2f08d2 in blink::TextFieldInputType::didSetValueByUserEdit(blink::TextFieldInputType::ValueChangeState) third_party/WebKit/Source/core/html/forms/TextFieldInputType.cpp:502:10\n #3 0x7efd4a2f0814 in blink::TextFieldInputType::subtreeHasChanged() third_party/WebKit/Source/core/html/forms/TextFieldInputType.cpp:497:5\n #4 0x7efd4a189606 in blink::HTMLInputElement::subtreeHasChanged() third_party/WebKit/Source/core/html/HTMLInputElement.cpp:525:5\n #5 0x7efd4a24d587 in blink::HTMLTextFormControlElement::setRangeText(WTF::String const&, unsigned int, unsigned int, WTF::String const&, blink::ExceptionState&) third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp:240:5\n #6 0x7efd4a199788 in blink::HTMLInputElement::setRangeText(WTF::String const&, unsigned int, unsigned int, WTF::String const&, blink::ExceptionState&) third_party/WebKit/Source/core/html/HTMLInputElement.cpp:1827:5\n #7 0x7efd4bfbbeda in blink::HTMLInputElementV8Internal::setRangeText2Method(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8HTMLInputElement.cpp:1868:5\n #8 0x7efd4bfbb06b in blink::HTMLInputElementV8Internal::setRangeTextMethod(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8HTMLInputElement.cpp:1887:13\n #9 0x7efd4bfb99f6 in blink::HTMLInputElementV8Internal::setRangeTextMethodCallback(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8HTMLInputElement.cpp:1918:5\n #10 0x7efd487ade01 in v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo const&)) v8/src/arguments.cc:33:3\n #11 0x7efd47c15785 in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>) v8/src/builtins.cc:1979:34\n #12 0x7efd47c3c463 in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>, v8::internal::Isolate*) v8/src/builtins.cc:2003:3\n #13 0x7efd47c1869f in v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) v8/src/builtins.cc:2000:1\n #14 0x7efbc430a77a ()\n #15 0x7efbc43420f9 ()\n #16 0x7efbc4337383 ()\n #17 0x7efbc4319c41 ()\n #14 0x7efd48019d60 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle) v8/src/execution.cc:98:13\n #15 0x7efd48018e8c in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:168:10\n #16 0x7efd47b20f93 in v8::Script::Run(v8::Local) v8/src/api.cc:1716:23\n #17 0x7efd4bcd9d57 in blink::V8ScriptRunner::runCompiledScript(v8::Isolate*, v8::Local, blink::ExecutionContext*) third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp:393:18\n #18 0x7efd4bc1ffa5 in blink::ScriptController::executeScriptAndReturnValue(v8::Local, blink::ScriptSourceCode const&, blink::AccessControlStatus, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:190:21\n #19 0x7efd4bc24b76 in blink::ScriptController::evaluateScriptInMainWorld(blink::ScriptSourceCode const&, blink::AccessControlStatus, blink::ScriptController::ExecuteScriptPolicy, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:566:35\n #20 0x7efd4bc251f7 in blink::ScriptController::executeScriptInMainWorld(blink::ScriptSourceCode const&, blink::AccessControlStatus, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:539:5\n #21 0x7efd4a0bdf68 in blink::ScriptLoader::executeScript(blink::ScriptSourceCode const&, double*) third_party/WebKit/Source/core/dom/ScriptLoader.cpp:422:5\n #22 0x7efd4a0b9e2f in blink::ScriptLoader::prepareScript(WTF::TextPosition const&, blink::ScriptLoader::LegacyTypeSupport) third_party/WebKit/Source/core/dom/ScriptLoader.cpp:273:14\n #23 0x7efd4a347842 in blink::HTMLScriptRunner::runScript(blink::Element*, WTF::TextPosition const&) third_party/WebKit/Source/core/html/parser/HTMLScriptRunner.cpp:353:9\n #24 0x7efd4a34741e in blink::HTMLScriptRunner::execute(WTF::PassRefPtr, WTF::TextPosition const&) third_party/WebKit/Source/core/html/parser/HTMLScriptRunner.cpp:215:5\n #25 0x7efd4a30dc2a in blink::HTMLDocumentParser::runScriptsForPausedTreeBuilder() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:331:9\n #26 0x7efd4a311915 in blink::HTMLDocumentParser::processParsedChunkFromBackgroundParser(WTF::PassOwnPtr) third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:526:13\n #27 0x7efd4a30d2f1 in blink::HTMLDocumentParser::pumpPendingSpeculations() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:587:36\n #28 0x7efd4a30cec6 in blink::HTMLDocumentParser::resumeParsingAfterYield() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:320:5\n #29 0x7efd54a649e4 in blink::CancellableTaskFactory::CancellableTask::run() third_party/WebKit/Source/platform/scheduler/CancellableTaskFactory.cpp:29:9\n #30 0x7efd4ecd9d2e in base::internal::RunnableAdapter >)>::Run(scoped_ptr >) base/bind_internal.h:153:12\n #31 0x7efd4ecd9b57 in base::internal::InvokeHelper >)>, base::internal::TypeList > > >::MakeItSo(base::internal::RunnableAdapter >)>, scoped_ptr >) base/bind_internal.h:289:5\n #32 0x7efd4ecd99f3 in base::internal::Invoker, base::internal::BindState >)>, void (scoped_ptr >), base::internal::PassedWrapper > > >, base::internal::TypeList > > > >, base::internal::InvokeHelper >)>, base::internal::TypeList > > >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:339:12\n #33 0x7efd44463287 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #34 0x7efd4ecf7ca7 in scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(scheduler::internal::WorkQueue*, scheduler::internal::TaskQueueImpl::Task*) components/scheduler/base/task_queue_manager.cc:264:3\n #35 0x7efd4ecf49ae in scheduler::TaskQueueManager::DoWork(base::TimeTicks, bool) components/scheduler/base/task_queue_manager.cc:180:13\n #36 0x7efd4ecfaafa in base::internal::InvokeHelper, base::internal::TypeList const&, base::TimeTicks const&, bool const&> >::MakeItSo(base::internal::RunnableAdapter, base::WeakPtr const&, base::TimeTicks const&, bool const&) base/bind_internal.h:299:5\n #37 0x7efd44463287 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #38 0x7efd442ec6f9 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:487:3\n #39 0x7efd442ed48d in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:496:5\n #40 0x7efd442edae2 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:608:13\n #41 0x7efd442fac35 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:32:21\n #42 0x7efd442ebbd5 in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:451:3\n #43 0x7efd44349bd4 in base::RunLoop::Run() base/run_loop.cc:55:3\n #44 0x7efd442e9548 in base::MessageLoop::Run() base/message_loop/message_loop.cc:289:3\n #45 0x7efd4ee49eb6 in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:228:7\n #46 0x7efd44195b38 in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:303:14\n #47 0x7efd44196ac0 in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:387:12\n #48 0x7efd44199811 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:796:12\n #49 0x7efd44194bd1 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #50 0x7efd42e5d979 in ChromeMain chrome/app/chrome_main.cc:66:12\n #51 0x7efd3823dec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\n0x60f00003b280 is located 16 bytes inside of 112-byte region [0x60f00003b270,0x60f00003b2e0)\nfreed by thread T0 (chrome) here:\n #0 0x7efd42e32fdb in __interceptor_free\n #1 0x7efd4a19be58 in WTF::RefCounted::deref() third_party/WebKit/Source/wtf/RefCounted.h:176:13\n #2 0x7efd4a18837d in derefIfNotNull third_party/WebKit/Source/wtf/PassRefPtr.h:55:9\n #3 0x7efd4a18837d in ~RefPtr third_party/WebKit/Source/wtf/RefPtr.h:57\n #4 0x7efd4a18837d in blink::HTMLInputElement::updateType() third_party/WebKit/Source/core/html/HTMLInputElement.cpp:474\n #5 0x7efd4a18c35c in blink::HTMLInputElement::parseAttribute(blink::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&) third_party/WebKit/Source/core/html/HTMLInputElement.cpp:689:9\n #6 0x7efd49e14334 in blink::Element::attributeChanged(blink::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&, blink::Element::AttributeModificationReason) third_party/WebKit/Source/core/dom/Element.cpp:1200:5\n #7 0x7efd49e314b1 in blink::Element::didModifyAttribute(blink::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&) third_party/WebKit/Source/core/dom/Element.cpp:3139:5\n #8 0x7efd49e07756 in setAttributeInternal third_party/WebKit/Source/core/dom/Element.cpp:1183:9\n #9 0x7efd49e07756 in blink::Element::setAttribute(blink::QualifiedName const&, WTF::AtomicString const&) third_party/WebKit/Source/core/dom/Element.cpp:1152\n #10 0x7efd4bfb5c2f in blink::HTMLInputElementV8Internal::typeAttributeSetter(v8::Local, v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8HTMLInputElement.cpp:1123:5\n #11 0x7efd4bfad4ac in blink::HTMLInputElementV8Internal::typeAttributeSetterCallback(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8HTMLInputElement.cpp:1131:5\n #12 0x7efd487ade01 in v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo const&)) v8/src/arguments.cc:33:3\n #13 0x7efd47c15785 in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>) v8/src/builtins.cc:1979:34\n #14 0x7efd47c1476d in v8::internal::Builtins::InvokeApiFunction(v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/builtins.cc:2090:14\n #15 0x7efd48019351 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:157:18\n #16 0x7efd482b3e95 in v8::internal::Object::SetPropertyWithDefinedSetter(v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::Object::ShouldThrow) v8/src/objects.cc:1158:3\n #17 0x7efd482b375e in v8::internal::Object::SetPropertyWithAccessor(v8::internal::LookupIterator*, v8::internal::Handle, v8::internal::Object::ShouldThrow) v8/src/objects.cc:1118:12\n #18 0x7efd482ea62e in v8::internal::Object::SetPropertyInternal(v8::internal::LookupIterator*, v8::internal::Handle, v8::internal::LanguageMode, v8::internal::Object::StoreFromKeyed, bool*) v8/src/objects.cc:3898:16\n #19 0x7efd482e9c2a in v8::internal::Object::SetProperty(v8::internal::LookupIterator*, v8::internal::Handle, v8::internal::LanguageMode, v8::internal::Object::StoreFromKeyed) v8/src/objects.cc:3941:7\n #20 0x7efd481f5001 in v8::internal::StoreIC::Store(v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::Object::StoreFromKeyed) v8/src/ic/ic.cc:1544:3\n #21 0x7efd481ff312 in __RT_impl_Runtime_StoreIC_Miss v8/src/ic/ic.cc:2307:5\n #22 0x7efd481ff312 in v8::internal::Runtime_StoreIC_Miss(int, v8::internal::Object**, v8::internal::Isolate*) v8/src/ic/ic.cc:2291\n #19 0x7efbc430a77a ()\n #20 0x7efbc43422d9 ()\n #21 0x7efbc430d756 ()\n #22 0x7efbc4337383 ()\n #23 0x7efbc4319c41 ()\n #23 0x7efd48019d60 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle) v8/src/execution.cc:98:13\n #24 0x7efd48018e8c in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:168:10\n #25 0x7efd47b588d0 in v8::Function::Call(v8::Local, v8::Local, int, v8::Local*) v8/src/api.cc:4377:7\n #26 0x7efd4bcdae35 in blink::V8ScriptRunner::callFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp:441:40\n #27 0x7efd4bc1f94a in blink::ScriptController::callFunction(v8::Local, v8::Local, int, v8::Local*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:154:12\n #28 0x7efd4c36d8c0 in blink::V8EventListener::callListenerFunction(blink::ScriptState*, v8::Local, blink::Event*) third_party/WebKit/Source/bindings/core/v8/V8EventListener.cpp:95:10\n #29 0x7efd4bc7dc2d in blink::V8AbstractEventListener::invokeEventHandler(blink::ScriptState*, blink::Event*, v8::Local) third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:139:23\n #30 0x7efd4bc7d807 in blink::V8AbstractEventListener::handleEvent(blink::ScriptState*, blink::Event*) third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:100:5\n #31 0x7efd4bc7d53e in blink::V8AbstractEventListener::handleEvent(blink::ExecutionContext*, blink::Event*) third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:85:5\n #32 0x7efd4a01bf6b in blink::EventTarget::fireEventListeners(blink::Event*, blink::EventTargetData*, WTF::Vector&) third_party/WebKit/Source/core/events/EventTarget.cpp:436:9\n #33 0x7efd4a01a9fb in blink::EventTarget::fireEventListeners(blink::Event*) third_party/WebKit/Source/core/events/EventTarget.cpp:362:9\n #34 0x7efd49ec2c0d in blink::Node::handleLocalEvents(blink::Event&) third_party/WebKit/Source/core/dom/Node.cpp:1980:5\n #35 0x7efd4a03242f in blink::NodeEventContext::handleLocalEvents(blink::Event&) const third_party/WebKit/Source/core/events/NodeEventContext.cpp:67:5\n #36 0x7efd49ff75c8 in blink::EventDispatcher::dispatchEventAtTarget() third_party/WebKit/Source/core/events/EventDispatcher.cpp:171:5\n #37 0x7efd49ff68ed in blink::EventDispatcher::dispatch() third_party/WebKit/Source/core/events/EventDispatcher.cpp:126:17\n #38 0x7efd49ff449c in blink::EventDispatcher::dispatchEvent(blink::Node&, WTF::PassRefPtr) third_party/WebKit/Source/core/events/EventDispatcher.cpp:50:12\n #39 0x7efd49ec2ff1 in blink::Node::dispatchEventInternal(WTF::PassRefPtr) third_party/WebKit/Source/core/dom/Node.cpp:1991:12\n #40 0x7efd4a01a4c0 in blink::EventTarget::dispatchEvent(WTF::PassRefPtr) third_party/WebKit/Source/core/events/EventTarget.cpp:271:12\n #41 0x7efd4a1947b0 in blink::HTMLInputElement::onSearch() third_party/WebKit/Source/core/html/HTMLInputElement.cpp:1488:5\n #42 0x7efd4a2e614f in blink::SearchInputType::startSearchEventTimer() third_party/WebKit/Source/core/html/forms/SearchInputType.cpp:117:9\n #43 0x7efd4a2e632c in blink::SearchInputType::didSetValueByUserEdit(blink::TextFieldInputType::ValueChangeState) third_party/WebKit/Source/core/html/forms/SearchInputType.cpp:147:9\n #44 0x7efd4a2f0814 in blink::TextFieldInputType::subtreeHasChanged() third_party/WebKit/Source/core/html/forms/TextFieldInputType.cpp:497:5\n #45 0x7efd4a189606 in blink::HTMLInputElement::subtreeHasChanged() third_party/WebKit/Source/core/html/HTMLInputElement.cpp:525:5\n #46 0x7efd4a24d587 in blink::HTMLTextFormControlElement::setRangeText(WTF::String const&, unsigned int, unsigned int, WTF::String const&, blink::ExceptionState&) third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp:240:5\n #47 0x7efd4a199788 in blink::HTMLInputElement::setRangeText(WTF::String const&, unsigned int, unsigned int, WTF::String const&, blink::ExceptionState&) third_party/WebKit/Source/core/html/HTMLInputElement.cpp:1827:5\n #48 0x7efd4bfbbeda in blink::HTMLInputElementV8Internal::setRangeText2Method(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8HTMLInputElement.cpp:1868:5\n #49 0x7efd4bfbb06b in blink::HTMLInputElementV8Internal::setRangeTextMethod(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8HTMLInputElement.cpp:1887:13\n #50 0x7efd4bfb99f6 in blink::HTMLInputElementV8Internal::setRangeTextMethodCallback(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8HTMLInputElement.cpp:1918:5\n #51 0x7efd487ade01 in v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo const&)) v8/src/arguments.cc:33:3\n #52 0x7efd47c15785 in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>) v8/src/builtins.cc:1979:34\n #53 0x7efd47c3c463 in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>, v8::internal::Isolate*) v8/src/builtins.cc:2003:3\n #54 0x7efd47c1869f in v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) v8/src/builtins.cc:2000:1\n #56 0x7efbc430a77a ()\n #57 0x7efbc43420f9 ()\n #58 0x7efbc4337383 ()\n #59 0x7efbc4319c41 ()\n #55 0x7efd48019d60 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle) v8/src/execution.cc:98:13\n #56 0x7efd48018e8c in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:168:10\n #57 0x7efd47b20f93 in v8::Script::Run(v8::Local) v8/src/api.cc:1716:23\n #58 0x7efd4bcd9d57 in blink::V8ScriptRunner::runCompiledScript(v8::Isolate*, v8::Local, blink::ExecutionContext*) third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp:393:18\n #59 0x7efd4bc1ffa5 in blink::ScriptController::executeScriptAndReturnValue(v8::Local, blink::ScriptSourceCode const&, blink::AccessControlStatus, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:190:21\n #60 0x7efd4bc24b76 in blink::ScriptController::evaluateScriptInMainWorld(blink::ScriptSourceCode const&, blink::AccessControlStatus, blink::ScriptController::ExecuteScriptPolicy, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:566:35\n #61 0x7efd4bc251f7 in blink::ScriptController::executeScriptInMainWorld(blink::ScriptSourceCode const&, blink::AccessControlStatus, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:539:5\n #62 0x7efd4a0bdf68 in blink::ScriptLoader::executeScript(blink::ScriptSourceCode const&, double*) third_party/WebKit/Source/core/dom/ScriptLoader.cpp:422:5\n #63 0x7efd4a0b9e2f in blink::ScriptLoader::prepareScript(WTF::TextPosition const&, blink::ScriptLoader::LegacyTypeSupport) third_party/WebKit/Source/core/dom/ScriptLoader.cpp:273:14\n #64 0x7efd4a347842 in blink::HTMLScriptRunner::runScript(blink::Element*, WTF::TextPosition const&) third_party/WebKit/Source/core/html/parser/HTMLScriptRunner.cpp:353:9\n #65 0x7efd4a34741e in blink::HTMLScriptRunner::execute(WTF::PassRefPtr, WTF::TextPosition const&) third_party/WebKit/Source/core/html/parser/HTMLScriptRunner.cpp:215:5\n #66 0x7efd4a30dc2a in blink::HTMLDocumentParser::runScriptsForPausedTreeBuilder() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:331:9\n #67 0x7efd4a311915 in blink::HTMLDocumentParser::processParsedChunkFromBackgroundParser(WTF::PassOwnPtr) third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:526:13\n #68 0x7efd4a30d2f1 in blink::HTMLDocumentParser::pumpPendingSpeculations() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:587:36\n #69 0x7efd4a30cec6 in blink::HTMLDocumentParser::resumeParsingAfterYield() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:320:5\n #70 0x7efd54a649e4 in blink::CancellableTaskFactory::CancellableTask::run() third_party/WebKit/Source/platform/scheduler/CancellableTaskFactory.cpp:29:9\n #71 0x7efd4ecd9d2e in base::internal::RunnableAdapter >)>::Run(scoped_ptr >) base/bind_internal.h:153:12\n #72 0x7efd4ecd9b57 in base::internal::InvokeHelper >)>, base::internal::TypeList > > >::MakeItSo(base::internal::RunnableAdapter >)>, scoped_ptr >) base/bind_internal.h:289:5\n #73 0x7efd4ecd99f3 in base::internal::Invoker, base::internal::BindState >)>, void (scoped_ptr >), base::internal::PassedWrapper > > >, base::internal::TypeList > > > >, base::internal::InvokeHelper >)>, base::internal::TypeList > > >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:339:12\n #74 0x7efd44463287 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #75 0x7efd4ecf7ca7 in scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(scheduler::internal::WorkQueue*, scheduler::internal::TaskQueueImpl::Task*) components/scheduler/base/task_queue_manager.cc:264:3\n #76 0x7efd4ecf49ae in scheduler::TaskQueueManager::DoWork(base::TimeTicks, bool) components/scheduler/base/task_queue_manager.cc:180:13\n #77 0x7efd4ecfaafa in base::internal::InvokeHelper, base::internal::TypeList const&, base::TimeTicks const&, bool const&> >::MakeItSo(base::internal::RunnableAdapter, base::WeakPtr const&, base::TimeTicks const&, bool const&) base/bind_internal.h:299:5\n #78 0x7efd44463287 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #79 0x7efd442ec6f9 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:487:3\n #80 0x7efd442ed48d in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:496:5\n #81 0x7efd442edae2 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:608:13\n #82 0x7efd442fac35 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:32:21\n #83 0x7efd442ebbd5 in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:451:3\n #84 0x7efd44349bd4 in base::RunLoop::Run() base/run_loop.cc:55:3\n #85 0x7efd442e9548 in base::MessageLoop::Run() base/message_loop/message_loop.cc:289:3\n #86 0x7efd4ee49eb6 in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:228:7\n #87 0x7efd44195b38 in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:303:14\n #88 0x7efd44196ac0 in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:387:12\n #89 0x7efd44199811 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:796:12\n #90 0x7efd44194bd1 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #91 0x7efd42e5d979 in ChromeMain chrome/app/chrome_main.cc:66:12\n #92 0x7efd3823dec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\npreviously allocated by thread T0 (chrome) here:\n #0 0x7efd42e332fb in __interceptor_malloc\n #1 0x7efd476d64aa in partitionAllocGenericFlags third_party/WebKit/Source/wtf/PartitionAlloc.h:747:20\n #2 0x7efd476d64aa in partitionAllocGeneric third_party/WebKit/Source/wtf/PartitionAlloc.h:774\n #3 0x7efd476d64aa in WTF::Partitions::fastMalloc(unsigned long, char const*) third_party/WebKit/Source/wtf/Partitions.h:108\n #4 0x7efd4a2e5313 in blink::SearchInputType::create(blink::HTMLInputElement&) third_party/WebKit/Source/core/html/forms/SearchInputType.cpp:57:31\n #5 0x7efd4a2c1bfe in blink::InputType::create(blink::HTMLInputElement&, WTF::AtomicString const&) third_party/WebKit/Source/core/html/forms/InputType.cpp:121:12\n #6 0x7efd4a188011 in blink::HTMLInputElement::updateType() third_party/WebKit/Source/core/html/HTMLInputElement.cpp:461:45\n #7 0x7efd4a18c35c in blink::HTMLInputElement::parseAttribute(blink::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&) third_party/WebKit/Source/core/html/HTMLInputElement.cpp:689:9\n #8 0x7efd49e14334 in blink::Element::attributeChanged(blink::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&, blink::Element::AttributeModificationReason) third_party/WebKit/Source/core/dom/Element.cpp:1200:5\n #9 0x7efd49e25210 in blink::Element::didAddAttribute(blink::QualifiedName const&, WTF::AtomicString const&) third_party/WebKit/Source/core/dom/Element.cpp:3130:5\n #10 0x7efd49e24d34 in blink::Element::appendAttributeInternal(blink::QualifiedName const&, WTF::AtomicString const&, blink::Element::SynchronizationOfLazyAttribute) third_party/WebKit/Source/core/dom/Element.cpp:2284:9\n #11 0x7efd49e0771d in setAttributeInternal third_party/WebKit/Source/core/dom/Element.cpp:1170:9\n #12 0x7efd49e0771d in blink::Element::setAttribute(blink::QualifiedName const&, WTF::AtomicString const&) third_party/WebKit/Source/core/dom/Element.cpp:1152\n #13 0x7efd4bfb5c2f in blink::HTMLInputElementV8Internal::typeAttributeSetter(v8::Local, v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8HTMLInputElement.cpp:1123:5\n #14 0x7efd4bfad4ac in blink::HTMLInputElementV8Internal::typeAttributeSetterCallback(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8HTMLInputElement.cpp:1131:5\n #15 0x7efd487ade01 in v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo const&)) v8/src/arguments.cc:33:3\n #16 0x7efd47c15785 in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>) v8/src/builtins.cc:1979:34\n #17 0x7efd47c1476d in v8::internal::Builtins::InvokeApiFunction(v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/builtins.cc:2090:14\n #18 0x7efd48019351 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:157:18\n #19 0x7efd482b3e95 in v8::internal::Object::SetPropertyWithDefinedSetter(v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::Object::ShouldThrow) v8/src/objects.cc:1158:3\n #20 0x7efd482b375e in v8::internal::Object::SetPropertyWithAccessor(v8::internal::LookupIterator*, v8::internal::Handle, v8::internal::Object::ShouldThrow) v8/src/objects.cc:1118:12\n #21 0x7efd482ea62e in v8::internal::Object::SetPropertyInternal(v8::internal::LookupIterator*, v8::internal::Handle, v8::internal::LanguageMode, v8::internal::Object::StoreFromKeyed, bool*) v8/src/objects.cc:3898:16\n #22 0x7efd482e9c2a in v8::internal::Object::SetProperty(v8::internal::LookupIterator*, v8::internal::Handle, v8::internal::LanguageMode, v8::internal::Object::StoreFromKeyed) v8/src/objects.cc:3941:7\n #23 0x7efd481f5001 in v8::internal::StoreIC::Store(v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::Object::StoreFromKeyed) v8/src/ic/ic.cc:1544:3\n #24 0x7efd481ff312 in __RT_impl_Runtime_StoreIC_Miss v8/src/ic/ic.cc:2307:5\n #25 0x7efd481ff312 in v8::internal::Runtime_StoreIC_Miss(int, v8::internal::Object**, v8::internal::Isolate*) v8/src/ic/ic.cc:2291\n #22 0x7efbc430a77a ()\n #23 0x7efbc4341fad ()\n #24 0x7efbc4337383 ()\n #25 0x7efbc4319c41 ()\n #26 0x7efd48019d60 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle) v8/src/execution.cc:98:13\n #27 0x7efd48018e8c in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:168:10\n #28 0x7efd47b20f93 in v8::Script::Run(v8::Local) v8/src/api.cc:1716:23\n #29 0x7efd4bcd9d57 in blink::V8ScriptRunner::runCompiledScript(v8::Isolate*, v8::Local, blink::ExecutionContext*) third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp:393:18\n #30 0x7efd4bc1ffa5 in blink::ScriptController::executeScriptAndReturnValue(v8::Local, blink::ScriptSourceCode const&, blink::AccessControlStatus, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:190:21\n #31 0x7efd4bc24b76 in blink::ScriptController::evaluateScriptInMainWorld(blink::ScriptSourceCode const&, blink::AccessControlStatus, blink::ScriptController::ExecuteScriptPolicy, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:566:35\n #32 0x7efd4bc251f7 in blink::ScriptController::executeScriptInMainWorld(blink::ScriptSourceCode const&, blink::AccessControlStatus, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:539:5\n #33 0x7efd4a0bdf68 in blink::ScriptLoader::executeScript(blink::ScriptSourceCode const&, double*) third_party/WebKit/Source/core/dom/ScriptLoader.cpp:422:5\n #34 0x7efd4a0b9e2f in blink::ScriptLoader::prepareScript(WTF::TextPosition const&, blink::ScriptLoader::LegacyTypeSupport) third_party/WebKit/Source/core/dom/ScriptLoader.cpp:273:14\n #35 0x7efd4a347842 in blink::HTMLScriptRunner::runScript(blink::Element*, WTF::TextPosition const&) third_party/WebKit/Source/core/html/parser/HTMLScriptRunner.cpp:353:9\n #36 0x7efd4a34741e in blink::HTMLScriptRunner::execute(WTF::PassRefPtr, WTF::TextPosition const&) third_party/WebKit/Source/core/html/parser/HTMLScriptRunner.cpp:215:5\n #37 0x7efd4a30dc2a in blink::HTMLDocumentParser::runScriptsForPausedTreeBuilder() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:331:9\n #38 0x7efd4a311915 in blink::HTMLDocumentParser::processParsedChunkFromBackgroundParser(WTF::PassOwnPtr) third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:526:13\n #39 0x7efd4a30d2f1 in blink::HTMLDocumentParser::pumpPendingSpeculations() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:587:36\n #40 0x7efd4a30cec6 in blink::HTMLDocumentParser::resumeParsingAfterYield() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:320:5\n #41 0x7efd54a649e4 in blink::CancellableTaskFactory::CancellableTask::run() third_party/WebKit/Source/platform/scheduler/CancellableTaskFactory.cpp:29:9\n #42 0x7efd4ecd9d2e in base::internal::RunnableAdapter >)>::Run(scoped_ptr >) base/bind_internal.h:153:12\n #43 0x7efd4ecd9b57 in base::internal::InvokeHelper >)>, base::internal::TypeList > > >::MakeItSo(base::internal::RunnableAdapter >)>, scoped_ptr >) base/bind_internal.h:289:5\n #44 0x7efd4ecd99f3 in base::internal::Invoker, base::internal::BindState >)>, void (scoped_ptr >), base::internal::PassedWrapper > > >, base::internal::TypeList > > > >, base::internal::InvokeHelper >)>, base::internal::TypeList > > >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:339:12\n #45 0x7efd44463287 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #46 0x7efd4ecf7ca7 in scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(scheduler::internal::WorkQueue*, scheduler::internal::TaskQueueImpl::Task*) components/scheduler/base/task_queue_manager.cc:264:3\n #47 0x7efd4ecf49ae in scheduler::TaskQueueManager::DoWork(base::TimeTicks, bool) components/scheduler/base/task_queue_manager.cc:180:13\n #48 0x7efd4ecfaafa in base::internal::InvokeHelper, base::internal::TypeList const&, base::TimeTicks const&, bool const&> >::MakeItSo(base::internal::RunnableAdapter, base::WeakPtr const&, base::TimeTicks const&, bool const&) base/bind_internal.h:299:5\n #49 0x7efd44463287 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #50 0x7efd442ec6f9 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:487:3\n #51 0x7efd442ed48d in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:496:5\n #52 0x7efd442edae2 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:608:13\n #53 0x7efd442fac35 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:32:21\n #54 0x7efd442ebbd5 in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:451:3\n #55 0x7efd44349bd4 in base::RunLoop::Run() base/run_loop.cc:55:3\n #56 0x7efd442e9548 in base::MessageLoop::Run() base/message_loop/message_loop.cc:289:3\n #57 0x7efd4ee49eb6 in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:228:7\n #58 0x7efd44195b38 in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:303:14\n #59 0x7efd44196ac0 in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:387:12\n #60 0x7efd44199811 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:796:12\n #61 0x7efd44194bd1 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #62 0x7efd42e5d979 in ChromeMain chrome/app/chrome_main.cc:66:12\n #63 0x7efd3823dec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-asan_linux-release_4392242b7f59878a2775b4607420a2b37e17ff13/symbolized/release/asan-symbolized-linux-release-365513/chrome+0xa091e02)\nShadow bytes around the buggy address:\n 0x0c1e7ffff600: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c1e7ffff610: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fa\n 0x0c1e7ffff620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c1e7ffff630: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa\n 0x0c1e7ffff640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fd fd\n=>0x0c1e7ffff650:[fd]fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa\n 0x0c1e7ffff660: fa fa fa fa fa fa fa fa fa fa fa fa fd fd fd fd\n 0x0c1e7ffff670: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa\n 0x0c1e7ffff680: fa fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00\n 0x0c1e7ffff690: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa\n 0x0c1e7ffff6a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap left redzone: fa\n Heap right redzone: fb\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack partial redzone: f4\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_crash_read.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_crash_read.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_crash_read.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_crash_read.txt.snap index 6a00297580..0d2b3226b9 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_crash_read.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_crash_read.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_unknown_crash_read.txt +--- { "text": "==1==ERROR: AddressSanitizer: unknown-crash on address 0x000000000006 at pc 0x00000056d8b2 bp 0x7fffff869d10 sp 0x7fffff869d08\nREAD of size 8 at 0x000000000006 thread T0\nSCARINESS: 13 (8-byte-read-unknown-crash)\n#0 0x56d8b1 in void rawspeed::FujiDecompressor::copy_line(rawspeed::FujiDecompressor::fuji_compressed_block*, rawspeed::FujiDecompressor::FujiStrip const&, int, rawspeed::FujiDecompressor::copy_line_to_xtrans(rawspeed::FujiDecompressor::fuji_compressed_block*, rawspeed::FujiDecompressor::FujiStrip const&, int) const::$_7&) const librawspeed/src/librawspeed/decompressors/FujiDecompressor.cpp:0:7\n#1 0x56d8b1 in rawspeed::FujiDecompressor::copy_line_to_xtrans(rawspeed::FujiDecompressor::fuji_compressed_block*, rawspeed::FujiDecompressor::FujiStrip const&, int) const librawspeed/src/librawspeed/decompressors/FujiDecompressor.cpp:215\n#2 0x57c3d7 in rawspeed::FujiDecompressor::fuji_decode_strip(rawspeed::FujiDecompressor::fuji_compressed_block*, rawspeed::FujiDecompressor::FujiStrip const&) const librawspeed/src/librawspeed/decompressors/FujiDecompressor.cpp:729:7\n#3 0x57cda3 in rawspeed::FujiDecompressor::decompressThreaded(rawspeed::RawDecompressorThread const*) const librawspeed/src/librawspeed/decompressors/FujiDecompressor.cpp:779:5\n#4 0x567893 in rawspeed::RawDecompressorThread::start_routine(void*) librawspeed/src/librawspeed/decompressors/AbstractParallelizedDecompressor.h:67:22\n#5 0x567393 in rawspeed::AbstractParallelizedDecompressor::decompressOne(unsigned int) const librawspeed/src/librawspeed/decompressors/AbstractParallelizedDecompressor.cpp:39:3\n#6 0x55318b in LLVMFuzzerTestOneInput librawspeed/fuzz/librawspeed/decompressors/FujiDecompressor.cpp:47:7\n#7 0x5b65c0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:515:13\n#8 0x58d175 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6\n#9 0x598b5b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:703:9\n#10 0x58c818 in main /src/libfuzzer/FuzzerMain.cpp:20:10\n#11 0x7fb3bc0f282f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/libc-start.c:291\n#12 0x453e78 in _start\nAddress 0x000000000006 is a wild pointer.\nSUMMARY: AddressSanitizer: unknown-crash (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_librawspeed_2ff020846f4a5625cb7009ec90f5f5a6dff4f645/revisions/FujiDecompressorFuzzer+0x56d8b1)\nShadow bytes around the buggy address:\n=>0x00007fff8000:[00]00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x00007fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x00007fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x00007fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x00007fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x00007fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\nAddressable: 00\nPartially addressable: 01 02 03 04 05 06 07\nHeap left redzone: fa\nFreed heap region: fd\nStack left redzone: f1\nStack mid redzone: f2\nStack right redzone: f3\nStack after return: f5\nStack use after scope: f8\nGlobal redzone: f9\nGlobal init order: f6\nPoisoned by user: f7\nContainer overflow: fc\nArray cookie: ac\nIntra object redzone: bb\nASan internal: fe\nLeft alloca redzone: ca\nRight alloca redzone: cb\n==1==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_crash_write.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_crash_write.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_crash_write.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_crash_write.txt.snap index 0adb64d425..feb1e3c7f0 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_crash_write.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_crash_write.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_unknown_crash_write.txt +--- { "text": "==1==ERROR: AddressSanitizer: unknown-crash on address 0x000000123456 at pc 0x00000056d8b2 bp 0x7fffff869d10 sp 0x7fffff869d08\nWRITE of size 8 at 0x000000123456 thread T0\nSCARINESS: 32 (8-byte-write-unknown-crash)\n#0 0x56d8b1 in void rawspeed::FujiDecompressor::copy_line(rawspeed::FujiDecompressor::fuji_compressed_block*, rawspeed::FujiDecompressor::FujiStrip const&, int, rawspeed::FujiDecompressor::copy_line_to_xtrans(rawspeed::FujiDecompressor::fuji_compressed_block*, rawspeed::FujiDecompressor::FujiStrip const&, int) const::$_7&) const librawspeed/src/librawspeed/decompressors/FujiDecompressor.cpp:0:7\n#1 0x56d8b1 in rawspeed::FujiDecompressor::copy_line_to_xtrans(rawspeed::FujiDecompressor::fuji_compressed_block*, rawspeed::FujiDecompressor::FujiStrip const&, int) const librawspeed/src/librawspeed/decompressors/FujiDecompressor.cpp:215\n#2 0x57c3d7 in rawspeed::FujiDecompressor::fuji_decode_strip(rawspeed::FujiDecompressor::fuji_compressed_block*, rawspeed::FujiDecompressor::FujiStrip const&) const librawspeed/src/librawspeed/decompressors/FujiDecompressor.cpp:729:7\n#3 0x57cda3 in rawspeed::FujiDecompressor::decompressThreaded(rawspeed::RawDecompressorThread const*) const librawspeed/src/librawspeed/decompressors/FujiDecompressor.cpp:779:5\n#4 0x567893 in rawspeed::RawDecompressorThread::start_routine(void*) librawspeed/src/librawspeed/decompressors/AbstractParallelizedDecompressor.h:67:22\n#5 0x567393 in rawspeed::AbstractParallelizedDecompressor::decompressOne(unsigned int) const librawspeed/src/librawspeed/decompressors/AbstractParallelizedDecompressor.cpp:39:3\n#6 0x55318b in LLVMFuzzerTestOneInput librawspeed/fuzz/librawspeed/decompressors/FujiDecompressor.cpp:47:7\n#7 0x5b65c0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:515:13\n#8 0x58d175 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6\n#9 0x598b5b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:703:9\n#10 0x58c818 in main /src/libfuzzer/FuzzerMain.cpp:20:10\n#11 0x7fb3bc0f282f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/libc-start.c:291\n#12 0x453e78 in _start\nAddress 0x000000123456 is a wild pointer.\nSUMMARY: AddressSanitizer: unknown-crash (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_librawspeed_2ff020846f4a5625cb7009ec90f5f5a6dff4f645/revisions/FujiDecompressorFuzzer+0x56d8b1)\nShadow bytes around the buggy address:\n=>0x00007fff8000:[00]00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x00007fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x00007fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x00007fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x00007fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n0x00007fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\nAddressable: 00\nPartially addressable: 01 02 03 04 05 06 07\nHeap left redzone: fa\nFreed heap region: fd\nStack left redzone: f1\nStack mid redzone: f2\nStack right redzone: f3\nStack after return: f5\nStack use after scope: f8\nGlobal redzone: f9\nGlobal init order: f6\nPoisoned by user: f7\nContainer overflow: fc\nArray cookie: ac\nIntra object redzone: bb\nASan internal: fe\nLeft alloca redzone: ca\nRight alloca redzone: cb\n==1==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_read.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_read.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_read.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_read.txt.snap index c8a82e029e..1bfe3bae12 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_read.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_read.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_unknown_read.txt +--- { "text": "ASAN:DEADLYSIGNAL\n=================================================================\n==1550==ERROR: AddressSanitizer: SEGV on unknown address 0x000000010008 (pc 0x7efef5995c27 bp 0x7fff15768f00 sp 0x7fff15768ef0 T0)\n==1550==The signal is caused by a READ memory access.\n==1550==Hint: address points to the zero page.\n #0 0x7efef5995c26 in operator-> buildtools/third_party/libc++/trunk/include/memory:2713:76\n #1 0x7efef5995c26 in content::NavigationEntryImpl::site_instance() const content/browser/frame_host/navigation_entry_impl.h:224\n #2 0x7efef599dd1b in content::NavigationControllerImpl::ClassifyNavigation(content::RenderFrameHostImpl*, FrameHostMsg_DidCommitProvisionalLoad_Params const&) const content/browser/frame_host/navigation_controller_impl.cc:1058:9\n #3 0x7efef599c379 in content::NavigationControllerImpl::RendererDidNavigate(content::RenderFrameHostImpl*, FrameHostMsg_DidCommitProvisionalLoad_Params const&, content::LoadCommittedDetails*) content/browser/frame_host/navigation_controller_impl.cc:866:19\n #4 0x7efef653f020 in content::NavigatorImpl::DidNavigate(content::RenderFrameHostImpl*, FrameHostMsg_DidCommitProvisionalLoad_Params const&) content/browser/frame_host/navigator_impl.cc:523:23\n #5 0x7efef59d6b5f in content::RenderFrameHostImpl::OnDidCommitProvisionalLoad(IPC::Message const&) content/browser/frame_host/render_frame_host_impl.cc:1083:3\n #6 0x7efef59d181c in content::RenderFrameHostImpl::OnMessageReceived(IPC::Message const&) content/browser/frame_host/render_frame_host_impl.cc:521:5\n #7 0x7efef5c4cffa in content::RenderProcessHostImpl::OnMessageReceived(IPC::Message const&) content/browser/renderer_host/render_process_host_impl.cc:1803:10\n #8 0x7efeeecf10ac in IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const&) ipc/ipc_channel_proxy.cc:293:3\n #9 0x7efeeecf793d in void base::internal::InvokeHelper >::MakeItSo(base::internal::RunnableAdapter, IPC::ChannelProxy::Context*&&, IPC::Message const&) base/bind_internal.h:301:5\n #10 0x7efeeecf77b4 in base::internal::Invoker, base::internal::BindState, void (IPC::ChannelProxy::Context*, IPC::Message const&), IPC::ChannelProxy::Context*, IPC::Message const&>, base::internal::InvokeHelper >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:352:12\n #11 0x7efeec743177 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #12 0x7efeec5b4b08 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:476:3\n #13 0x7efeec5b589d in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:485:5\n #14 0x7efeec5b5f42 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:597:13\n #15 0x7efeec73ae86 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:313:31\n #16 0x7efeec5b4054 in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #17 0x7efeec621e24 in base::RunLoop::Run() base/run_loop.cc:35:3\n #18 0x7efeebb7f6eb in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #19 0x7efef631f8b0 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:958:21\n #20 0x7efef58ab50f in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #21 0x7efef58a998c in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #22 0x7efeec45690a in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:398:14\n #23 0x7efeec459f7f in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:769:12\n #24 0x7efeec45401d in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #25 0x7efeeb09b0cc in ChromeMain chrome/app/chrome_main.cc:84:12\n #26 0x7efee03d1ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-asan_linux-release_4392242b7f59878a2775b4607420a2b37e17ff13/symbolized/release/asan-symbolized-linux-release-381276/chrome+0xd602c26)\n==1550==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_unknown.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_unknown.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_unknown.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_unknown.txt.snap index d5a8873d83..25d50bb243 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_unknown.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_unknown.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_unknown_unknown.txt +--- { "text": "ASAN:DEADLYSIGNAL\n=================================================================\n==1550==ERROR: AddressSanitizer: SEGV on unknown address 0x000000010530 (pc 0x7efef5995c27 bp 0x7fff15768f00 sp 0x7fff15768ef0 T0)\n==1550==The signal is caused by a UNKNOWN memory access.\n==1550==Hint: address points to the zero page.\n #0 0x7fda4ecc3242 in blink::Member::get() const third_party/WebKit/Source/platform/heap/Handle.h:824:29\n #1 0x7fda4ecc00d1 in blink::Document::styleEngine() third_party/WebKit/Source/core/dom/Document.h:385:71\n #2 0x7fda4fef7e5c in blink::Document::updateLayoutTreeIgnorePendingStylesheets() third_party/WebKit/Source/core/dom/Document.cpp:1990:53\n #3 0x7fda4fef825e in blink::Document::updateLayoutIgnorePendingStylesheets(blink::Document::RunPostLayoutTasks) third_party/WebKit/Source/core/dom/Document.cpp:2018:5\n #4 0x7fda50b99186 in blink::TextIteratorAlgorithm >::TextIteratorAlgorithm(blink::PositionTemplate > const&, blink::PositionTemplate > const&, unsigned int) third_party/WebKit/Source/core/editing/iterators/TextIterator.cpp:150:5\n #5 0x7fda50ba0f82 in blink::TextIteratorAlgorithm >::rangeLength(blink::PositionTemplate > const&, blink::PositionTemplate > const&, bool) third_party/WebKit/Source/core/editing/iterators/TextIterator.cpp:1096:42\n #6 0x7fda50bfea62 in blink::TextCheckingParagraph::checkingStart() const third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp:206:27\n #7 0x7fda50bfe68b in blink::TextCheckingParagraph::isRangeEmpty() const third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.h:73:40\n #8 0x7fda50bfe5fa in blink::TextCheckingParagraph::isEmpty() const third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp:182:12\n #9 0x7fda50bf5aa6 in blink::SpellChecker::chunkAndMarkAllMisspellingsAndBadGrammar(unsigned int, blink::TextCheckingParagraph const&) third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp:512:9\n #10 0x7fda50bf47d0 in blink::SpellChecker::markAllMisspellingsAndBadGrammarInRanges(unsigned int, blink::EphemeralRangeTemplate > const&, blink::EphemeralRangeTemplate > const&) third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp:479:5\n #11 0x7fda50bf3e6d in blink::SpellChecker::markMisspellingsAndBadGrammar(blink::VisibleSelectionTemplate > const&, bool, blink::VisibleSelectionTemplate > const&) third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp:640:9\n #12 0x7fda50bf1826 in blink::SpellChecker::didBeginEditing(blink::Element*) third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp:147:13\n #13 0x7fda4ff10813 in blink::Document::setFocusedElement(WTF::RawPtr, blink::FocusParams const&) third_party/WebKit/Source/core/dom/Document.cpp:3673:13\n #14 0x7fda5115d229 in blink::FocusController::setFocusedElement(blink::Element*, WTF::RawPtr, blink::FocusParams const&) third_party/WebKit/Source/core/page/FocusController.cpp:912:36\n #15 0x7fda5115ca98 in blink::FocusController::setFocusedElement(blink::Element*, WTF::RawPtr) third_party/WebKit/Source/core/page/FocusController.cpp:869:12\n #16 0x7fda50a72023 in blink::FrameSelection::setFocusedNodeIfNeeded() third_party/WebKit/Source/core/editing/FrameSelection.cpp:1112:17\n #17 0x7fda50a677cc in void blink::FrameSelection::setSelectionAlgorithm >(blink::VisibleSelectionTemplate > const&, unsigned int, blink::CursorAlignOnScroll, blink::TextGranularity) third_party/WebKit/Source/core/editing/FrameSelection.cpp:331:9\n #18 0x7fda50a6fa9a in blink::FrameSelection::selectAll() third_party/WebKit/Source/core/editing/FrameSelection.cpp:864:5\n #19 0x7fda50b48cb2 in blink::executeSelectAll(blink::LocalFrame&, blink::Event*, blink::EditorCommandSource, WTF::String const&) third_party/WebKit/Source/core/editing/commands/EditorCommand.cpp:1070:5\n #20 0x7fda50b41c8e in blink::Editor::Command::execute(WTF::String const&, blink::Event*) const third_party/WebKit/Source/core/editing/commands/EditorCommand.cpp:1792:12\n #21 0x7fda4ff1d5a3 in blink::Document::execCommand(WTF::String const&, bool, WTF::String const&, blink::ExceptionState&) third_party/WebKit/Source/core/dom/Document.cpp:4470:12\n #22 0x7fda523162d7 in blink::DocumentV8Internal::execCommandMethod(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8Document.cpp:4682:19\n #23 0x7fda5230c9b6 in blink::DocumentV8Internal::execCommandMethodCallback(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8Document.cpp:4693:5\n #24 0x7fda4e73f6f1 in v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo const&)) v8/src/arguments.cc:33:3\n #25 0x7fda4dac0e26 in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>) v8/src/builtins.cc:3671:34\n #26 0x7fda4db18613 in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>, v8::internal::Isolate*) v8/src/builtins.cc:3695:3\n #27 0x7fda4dac898a in v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) v8/src/builtins.cc:3692:1\n #28 0x7fd88a3089da ()\n #29 0x7fd88a406df3 ()\n #30 0x7fd88a3384a3 ()\n #31 0x7fd88a319da1 ()\n #28 0x7fda4df1633f in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle) v8/src/execution.cc:97:13\n #29 0x7fda4df1566c in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:163:10\n #30 0x7fda4d9c88c3 in v8::Script::Run(v8::Local) v8/src/api.cc:1717:23\n #31 0x7fda51ef234f in blink::V8ScriptRunner::runCompiledScript(v8::Isolate*, v8::Local, blink::ExecutionContext*) third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp:417:18\n #32 0x7fda51e31d16 in blink::ScriptController::executeScriptAndReturnValue(v8::Local, blink::ScriptSourceCode const&, blink::AccessControlStatus, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:192:21\n #33 0x7fda51e3661d in blink::ScriptController::evaluateScriptInMainWorld(blink::ScriptSourceCode const&, blink::AccessControlStatus, blink::ScriptController::ExecuteScriptPolicy, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:571:35\n #34 0x7fda51e36b97 in blink::ScriptController::executeScriptInMainWorld(blink::ScriptSourceCode const&, blink::AccessControlStatus, double*) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:544:5\n #35 0x7fda502be0f6 in blink::ScriptLoader::executeScript(blink::ScriptSourceCode const&, double*) third_party/WebKit/Source/core/dom/ScriptLoader.cpp:431:5\n #36 0x7fda502ba357 in blink::ScriptLoader::prepareScript(WTF::TextPosition const&, blink::ScriptLoader::LegacyTypeSupport) third_party/WebKit/Source/core/dom/ScriptLoader.cpp:280:14\n #37 0x7fda50567e90 in blink::HTMLScriptRunner::runScript(blink::Element*, WTF::TextPosition const&) third_party/WebKit/Source/core/html/parser/HTMLScriptRunner.cpp:427:9\n #38 0x7fda505678e2 in blink::HTMLScriptRunner::execute(WTF::RawPtr, WTF::TextPosition const&) third_party/WebKit/Source/core/html/parser/HTMLScriptRunner.cpp:283:5\n #39 0x7fda50525c1b in blink::HTMLDocumentParser::runScriptsForPausedTreeBuilder() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:330:9\n #40 0x7fda50529774 in blink::HTMLDocumentParser::processParsedChunkFromBackgroundParser(WTF::PassOwnPtr) third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:525:13\n #41 0x7fda505252fe in blink::HTMLDocumentParser::pumpPendingSpeculations() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:586:36\n #42 0x7fda50524ea5 in blink::HTMLDocumentParser::resumeParsingAfterYield() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:319:5\n #43 0x7fda5054f1f2 in WTF::FunctionWrapper::operator()(WTF::WeakPtr const&) third_party/WebKit/Source/wtf/Functional.h:99:16\n #44 0x7fda5054eb3b in WTF::PartBoundFunctionImpl<1, WTF::FunctionWrapper, void (blink::CrossThreadWeakPersistentThisPointer)>::operator()() third_party/WebKit/Source/wtf/Functional.h:182:16\n #45 0x7fda5aefa5e4 in blink::CancellableTaskFactory::CancellableTask::run() third_party/WebKit/Source/platform/scheduler/CancellableTaskFactory.cpp:28:9\n #46 0x7fda55fa9f3e in base::internal::RunnableAdapter >)>::Run(scoped_ptr >) base/bind_internal.h:158:12\n #47 0x7fda55fa9d67 in base::internal::InvokeHelper >)>, base::internal::TypeList > > >::MakeItSo(base::internal::RunnableAdapter >)>, scoped_ptr >) base/bind_internal.h:298:5\n #48 0x7fda55fa9c03 in base::internal::Invoker, base::internal::BindState >)>, void (scoped_ptr >), base::internal::PassedWrapper > > >, base::internal::TypeList > > > >, base::internal::InvokeHelper >)>, base::internal::TypeList > > >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:348:12\n #49 0x7fda49e2dac7 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #50 0x7fda55fc870d in scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(scheduler::internal::WorkQueue*, scheduler::internal::TaskQueueImpl::Task*) components/scheduler/base/task_queue_manager.cc:286:3\n #51 0x7fda55fc517e in scheduler::TaskQueueManager::DoWork(base::TimeTicks, bool) components/scheduler/base/task_queue_manager.cc:198:13\n #52 0x7fda55fcbf9a in base::internal::InvokeHelper, base::internal::TypeList const&, base::TimeTicks const&, bool const&> >::MakeItSo(base::internal::RunnableAdapter, base::WeakPtr const&, base::TimeTicks const&, bool const&) base/bind_internal.h:308:5\n #53 0x7fda49e2dac7 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #54 0x7fda49c94119 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:486:3\n #55 0x7fda49c94ead in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:495:5\n #56 0x7fda49c95542 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:607:13\n #57 0x7fda49ca3b79 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:33:21\n #58 0x7fda49c935f5 in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:450:3\n #59 0x7fda49d02c94 in base::RunLoop::Run() base/run_loop.cc:56:3\n #60 0x7fda49c90e28 in base::MessageLoop::Run() base/message_loop/message_loop.cc:293:3\n #61 0x7fda56132666 in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:226:7\n #62 0x7fda49b2e308 in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:294:14\n #63 0x7fda49b2ff32 in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:381:12\n #64 0x7fda49b332a1 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:742:12\n #65 0x7fda49b2d051 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #66 0x7fda48721d59 in ChromeMain chrome/app/chrome_main.cc:67:12\n #67 0x7fda3dc1fec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-release_3e8ee0f0e660f39ebe723667101aab55a53e781c/symbolized/release/asan-symbolized-linux-release-v8-component-33791/chrome+0x90a7242)\n==1==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_win_read.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_win_read.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_win_read.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_win_read.txt.snap index b523386e17..94f4049b0a 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_win_read.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_win_read.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_unknown_win_read.txt +--- { "text": "=================================================================\n==3316==ERROR: AddressSanitizer: access-violation on unknown address 0x00010008 (pc 0x59565ab9 bp 0x001ad27c sp 0x001ad000 T0)\n==3316==The signal is caused by a READ memory access.\n==3316==Hint: address points to the zero page.\nSCARINESS: 10 (null-deref)\n==3316==*** WARNING: Failed to initialize DbgHelp! ***\n==3316==*** Most likely this means that the app is already ***\n==3316==*** using DbgHelp, possibly with incompatible flags. ***\n==3316==*** Due to technical reasons, symbolization might crash ***\n==3316==*** or produce wrong results. ***\n==3316==WARNING: Failed to use and restart external symbolizer!\n #0 0x59565ab8 in blink::SVGEnumerationBase::calculateAnimatedValue third_party/WebKit/Source/core/svg/SVGEnumeration.cpp:90\n #1 0x594c249e in blink::SVGAnimateElement::calculateAnimatedValue third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp:378\n #2 0x594748c6 in blink::SVGAnimationElement::updateAnimation third_party/WebKit/Source/core/svg/SVGAnimationElement.cpp:617\n #3 0x59556967 in blink::SMILTimeContainer::updateAnimations third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp:485\n #4 0x595588d9 in blink::SMILTimeContainer::updateAnimationsAndScheduleFrameIfNeeded third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp:414\n #5 0x5955490c in blink::SMILTimeContainer::wakeupTimerFired third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp:289\n #6 0x58afdd31 in blink::TaskRunnerTimer::fired third_party/WebKit/Source/platform/Timer.h:144\n #7 0x56fb5842 in blink::TimerBase::runInternal third_party/WebKit/Source/platform/Timer.cpp:174\n #8 0x54876038 in base::debug::TaskAnnotator::RunTask base/debug/task_annotator.cc:57\n #9 0x5718efce in blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:533\n #10 0x5718a666 in blink::scheduler::TaskQueueManager::DoWork third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:331\n #11 0x5a99ba44 in base::internal::Invoker,bool>,void ()>::Run base/bind_internal.h:340\n #12 0x54876038 in base::debug::TaskAnnotator::RunTask base/debug/task_annotator.cc:57\n #13 0x5471fa1f in base::MessageLoop::RunTask base/message_loop/message_loop.cc:423\n #14 0x547208d6 in base::MessageLoop::DeferOrRunPendingTask base/message_loop/message_loop.cc:434\n #15 0x54721bf6 in base::MessageLoop::DoWork base/message_loop/message_loop.cc:527\n #16 0x5487c3ba in base::MessagePumpDefault::Run base/message_loop/message_pump_default.cc:33\n #17 0x5471ea59 in base::MessageLoop::RunHandler base/message_loop/message_loop.cc:387\n #18 0x547a0efd in base::RunLoop::Run base/run_loop.cc:37\n #19 0x5a853a26 in content::RendererMain content/renderer/renderer_main.cc:200\n #20 0x545a0015 in content::RunNamedProcessTypeMain content/app/content_main_runner.cc:491\n #21 0x545a13da in content::ContentMainRunnerImpl::Run content/app/content_main_runner.cc:836\n #22 0x5459fc00 in content::ContentMain content/app/content_main.cc:20\n #23 0x514a11c2 in ChromeMain chrome/app/chrome_main.cc:121\n #24 0x9a97d9 in MainDllLoader::Launch chrome/app/main_dll_loader_win.cc:201\n #25 0x9a1926 in main chrome/app/chrome_exe_main_win.cc:271\n #26 0xbe26ba in __scrt_common_main_seh f:\\dd\\vctools\\crt\\vcstartup\\src\\startup\\exe_common.inl:253\n #27 0x76837c03 in BaseThreadInitThunk+0x23 (C:\\windows\\SYSTEM32\\KERNEL32.DLL+0x17c03)\n #28 0x7712ab8e in RtlInitializeExceptionChain+0x8e (C:\\windows\\SYSTEM32\\ntdll.dll+0x5ab8e)\n #29 0x7712ab59 in RtlInitializeExceptionChain+0x59 (C:\\windows\\SYSTEM32\\ntdll.dll+0x5ab59)\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: access-violation third_party\\WebKit\\Source\\core\\svg\\SVGEnumeration.cpp:90 in blink::SVGEnumerationBase::calculateAnimatedValue\n==3316==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_win_write.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_win_write.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_win_write.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_win_write.txt.snap index 354f79cfb3..2d65398b6c 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_win_write.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_win_write.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_unknown_win_write.txt +--- { "text": "=================================================================\n==3316==ERROR: AddressSanitizer: access-violation on unknown address 0x00010008 (pc 0x59565ab9 bp 0x001ad27c sp 0x001ad000 T0)\n==3316==The signal is caused by a WRITE memory access.\n==3316==Hint: address points to the zero page.\nSCARINESS: 10 (null-deref)\n==3316==*** WARNING: Failed to initialize DbgHelp! ***\n==3316==*** Most likely this means that the app is already ***\n==3316==*** using DbgHelp, possibly with incompatible flags. ***\n==3316==*** Due to technical reasons, symbolization might crash ***\n==3316==*** or produce wrong results. ***\n==3316==WARNING: Failed to use and restart external symbolizer!\n #0 0x59565ab8 in blink::SVGEnumerationBase::calculateAnimatedValue third_party/WebKit/Source/core/svg/SVGEnumeration.cpp:90\n #1 0x594c249e in blink::SVGAnimateElement::calculateAnimatedValue third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp:378\n #2 0x594748c6 in blink::SVGAnimationElement::updateAnimation third_party/WebKit/Source/core/svg/SVGAnimationElement.cpp:617\n #3 0x59556967 in blink::SMILTimeContainer::updateAnimations third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp:485\n #4 0x595588d9 in blink::SMILTimeContainer::updateAnimationsAndScheduleFrameIfNeeded third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp:414\n #5 0x5955490c in blink::SMILTimeContainer::wakeupTimerFired third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp:289\n #6 0x58afdd31 in blink::TaskRunnerTimer::fired third_party/WebKit/Source/platform/Timer.h:144\n #7 0x56fb5842 in blink::TimerBase::runInternal third_party/WebKit/Source/platform/Timer.cpp:174\n #8 0x54876038 in base::debug::TaskAnnotator::RunTask base/debug/task_annotator.cc:57\n #9 0x5718efce in blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:533\n #10 0x5718a666 in blink::scheduler::TaskQueueManager::DoWork third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:331\n #11 0x5a99ba44 in base::internal::Invoker,bool>,void ()>::Run base/bind_internal.h:340\n #12 0x54876038 in base::debug::TaskAnnotator::RunTask base/debug/task_annotator.cc:57\n #13 0x5471fa1f in base::MessageLoop::RunTask base/message_loop/message_loop.cc:423\n #14 0x547208d6 in base::MessageLoop::DeferOrRunPendingTask base/message_loop/message_loop.cc:434\n #15 0x54721bf6 in base::MessageLoop::DoWork base/message_loop/message_loop.cc:527\n #16 0x5487c3ba in base::MessagePumpDefault::Run base/message_loop/message_pump_default.cc:33\n #17 0x5471ea59 in base::MessageLoop::RunHandler base/message_loop/message_loop.cc:387\n #18 0x547a0efd in base::RunLoop::Run base/run_loop.cc:37\n #19 0x5a853a26 in content::RendererMain content/renderer/renderer_main.cc:200\n #20 0x545a0015 in content::RunNamedProcessTypeMain content/app/content_main_runner.cc:491\n #21 0x545a13da in content::ContentMainRunnerImpl::Run content/app/content_main_runner.cc:836\n #22 0x5459fc00 in content::ContentMain content/app/content_main.cc:20\n #23 0x514a11c2 in ChromeMain chrome/app/chrome_main.cc:121\n #24 0x9a97d9 in MainDllLoader::Launch chrome/app/main_dll_loader_win.cc:201\n #25 0x9a1926 in main chrome/app/chrome_exe_main_win.cc:271\n #26 0xbe26ba in __scrt_common_main_seh f:\\dd\\vctools\\crt\\vcstartup\\src\\startup\\exe_common.inl:253\n #27 0x76837c03 in BaseThreadInitThunk+0x23 (C:\\windows\\SYSTEM32\\KERNEL32.DLL+0x17c03)\n #28 0x7712ab8e in RtlInitializeExceptionChain+0x8e (C:\\windows\\SYSTEM32\\ntdll.dll+0x5ab8e)\n #29 0x7712ab59 in RtlInitializeExceptionChain+0x59 (C:\\windows\\SYSTEM32\\ntdll.dll+0x5ab59)\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: access-violation third_party\\WebKit\\Source\\core\\svg\\SVGEnumeration.cpp:90 in blink::SVGEnumerationBase::calculateAnimatedValue\n==3316==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_write.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_write.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_write.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_write.txt.snap index 695241fe07..99aa135353 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/asan_unknown_write.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@asan_unknown_write.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/asan_unknown_write.txt +--- { "text": "ASAN:DEADLYSIGNAL\n=================================================================\n==29409==ERROR: AddressSanitizer: SEGV on unknown address 0x000000010178 (pc 0x7f5eae7977d1 bp 0x7ffcc670d840 sp 0x7ffcc670cfd8 T0)\n==29409==The signal is caused by a WRITE memory access.\n==29409==Hint: address points to the zero page.\n #0 0x7f5eae7977d0 in memcpy-ssse3-back.S:1702 /build/eglibc-rrybNj/eglibc-2.15/sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:1702\n #1 0x7f5eba8358a1 in SetTaskInfo base/timer/timer.cc:145:16\n #2 0x7f5eba8358a1 in base::Timer::Start(tracked_objects::Location const&, base::TimeDelta, base::Callback const&) base/timer/timer.cc:105\n #3 0x7f5eca365821 in Start base/timer/timer.h:224:5\n #4 0x7f5eca365821 in StartCancelAllTimer ui/views/controls/menu/menu_controller.cc:1832\n #5 0x7f5eca365821 in views::MenuController::OnDragExited(views::SubmenuView*) ui/views/controls/menu/menu_controller.cc:925\n #6 0x7f5eca59bd42 in NotifyDragExit ui/views/widget/drop_helper.cc:154:5\n #7 0x7f5eca59bd42 in views::DropHelper::OnDragExit() ui/views/widget/drop_helper.cc:47\n #8 0x7f5eca5c18f0 in NotifyDragLeave ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc:1019:5\n #9 0x7f5eca5c18f0 in views::DesktopDragDropClientAuraX11::~DesktopDragDropClientAuraX11() ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc:447\n #10 0x7f5eca5c1f0a in views::DesktopDragDropClientAuraX11::~DesktopDragDropClientAuraX11() ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc:443:63\n #11 0x7f5eca52b660 in operator() buildtools/third_party/libc++/trunk/include/memory:2529:13\n #12 0x7f5eca52b660 in reset buildtools/third_party/libc++/trunk/include/memory:2735\n #13 0x7f5eca52b660 in views::DesktopNativeWidgetAura::OnDesktopWindowTreeHostDestroyed(aura::WindowTreeHost*) ui/views/widget/desktop_aura/desktop_native_widget_aura.cc:355\n #14 0x7f5eca5438d9 in views::DesktopWindowTreeHostX11::~DesktopWindowTreeHostX11() ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc:184:3\n #15 0x7f5eca543f3e in ~DesktopWindowTreeHostX11 ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc:181:55\n #16 0x7f5eca543f3e in non-virtual thunk to views::DesktopWindowTreeHostX11::~DesktopWindowTreeHostX11() ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc:181\n #17 0x7f5eca52b012 in operator() buildtools/third_party/libc++/trunk/include/memory:2529:13\n #18 0x7f5eca52b012 in reset buildtools/third_party/libc++/trunk/include/memory:2735\n #19 0x7f5eca52b012 in views::DesktopNativeWidgetAura::OnHostClosed() ui/views/widget/desktop_aura/desktop_native_widget_aura.cc:330\n #20 0x7f5eca54d397 in views::DesktopWindowTreeHostX11::CloseNow() ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc:392:3\n #21 0x7f5eca567bdf in Run<> base/bind_internal.h:181:12\n #22 0x7f5eca567bdf in MakeItSo> base/bind_internal.h:314\n #23 0x7f5eca567bdf in base::internal::Invoker, base::internal::BindState, void (views::DesktopWindowTreeHostX11*), base::WeakPtr >, base::internal::InvokeHelper >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:351\n #24 0x7f5eba8c5fe9 in Run base/callback.h:394:12\n #25 0x7f5eba8c5fe9 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51\n #26 0x7f5eba6fc007 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:476:3\n #27 0x7f5eba6fd05b in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:485:5\n #28 0x7f5eba6fdd7a in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:597:13\n #29 0x7f5eba8be1d7 in HandleDispatch base/message_loop/message_pump_glib.cc:267:7\n #30 0x7f5eba8be1d7 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:109\n #31 0x7f5eb5767d12 in g_main_dispatch /build/buildd/glib2.0-2.32.4/glib/gmain.c:2539\n #32 0x7f5eb5767d12 in g_main_context_dispatch /build/buildd/glib2.0-2.32.4/glib/gmain.c:3075\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x14e7d0)\n==29409==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/assert.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/assert.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert.txt.snap index f97f8a8f90..fdbf79a857 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/assert.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/assert.txt +--- { "text": "==2==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffdac2d7000; bottom 0x7f14c9be2000; size: 0x00e8e26f5000 (1000231358464)\nFalse positive error reports may follow\nFor details see http://code.google.com/p/address-sanitizer/issues/detail?id=189\n[32664:32664:0624/031900:50273919487:INFO:audio_manager_pulse.cc(258)] Failed to connect to the context. Error: Connection refused\n[32664:32664:0624/031902:50275429431:INFO:CONSOLE(138)] \"Uncaught TypeError: Cannot read property replace of undefined\", source: file:///mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-common-data-bundles/LayoutTests/resources/js-test.js (138)\nASSERTION FAILED: start.compareTo(end) <= 0\n../../third_party/WebKit/Source/core/editing/VisibleSelection.cpp(270) : void blink::normalizePositionsAlgorithm(const PositionType &, const PositionType &, PositionType *, PositionType *) [PositionType = blink::PositionAlgorithm]\n1 0x7f161a913b13 WTFReportBacktrace(int)\n2 0x7f162ddcf256\n3 0x7f162ddc0750\n4 0x7f162ddc051d\n5 0x7f162ddbffac\n6 0x7f1625917786\n7 0x7f1625ae0979\n8 0x7f163a01b67d content::RenderWidget::GetSelectionBounds(gfx::Rect*, gfx::Rect*)\n9 0x7f1639f5a7f9 content::RenderViewImpl::GetSelectionBounds(gfx::Rect*, gfx::Rect*)\n10 0x7f163a00e704 content::RenderWidget::UpdateSelectionBounds()\n11 0x7f163a00d2b3 content::RenderWidget::WillBeginCompositorFrame()\n12 0x7f1639a7378c content::RenderWidgetCompositor::WillBeginMainFrame()\n13 0x7f1639a737e7 non-virtual thunk to content::RenderWidgetCompositor::WillBeginMainFrame()\n14 0x7f1644c1c66a cc::LayerTreeHost::WillBeginMainFrame()\n15 0x7f1644e7aebe cc::ThreadProxy::BeginMainFrame(scoped_ptr >)\n16 0x7f1644eaa5c3\n17 0x7f1644eaa09b\n18 0x7f1644ea9dd9\n19 0x7f1649c6f11f\n20 0x7f1649d0754d base::debug::TaskAnnotator::RunTask(char const*, char const*, base::PendingTask const&)\n21 0x7f16545faef1 scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(unsigned long, bool, base::PendingTask*)\n22 0x7f16545f508c scheduler::TaskQueueManager::DoWork(bool)\n23 0x7f165464349e\n24 0x7f1654642fd0\n25 0x7f1654642d45\n26 0x7f1649c6f11f\n27 0x7f1649d0754d base::debug::TaskAnnotator::RunTask(char const*, char const*, base::PendingTask const&)\n28 0x7f1649efefde base::MessageLoop::RunTask(base::PendingTask const&)\n29 0x7f1649eff658 base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&)\n30 0x7f1649f00c35 base::MessageLoop::DoWork()\n31 0x7f1649f2e99f base::MessagePumpDefault::Run(base::MessagePump::Delegate*)\nASAN:SIGSEGV\n=================================================================\n==1==ERROR: AddressSanitizer: SEGV on unknown address 0x00009f7537dd (pc 0x7f162ddcf25d bp 0x7ffdac2cfda0 sp 0x7ffdac2cfc00 T0)\n #0 0x7f162ddcf25c in void blink::normalizePositionsAlgorithm >(blink::PositionAlgorithm const&, blink::PositionAlgorithm const&, blink::PositionAlgorithm*, blink::PositionAlgorithm*) third_party/WebKit/Source/core/editing/VisibleSelection.cpp:270:5\n #1 0x7f162ddc074f in blink::VisibleSelection::normalizePositions(blink::PositionAlgorithm const&, blink::PositionAlgorithm const&, blink::PositionAlgorithm*, blink::PositionAlgorithm*) third_party/WebKit/Source/core/editing/VisibleSelection.cpp:285:12\n #2 0x7f162ddc051c in blink::VisibleSelection::toNormalizedPositions(blink::PositionAlgorithm&, blink::PositionAlgorithm&) const third_party/WebKit/Source/core/editing/VisibleSelection.cpp:327:9\n #3 0x7f162ddbffab in blink::VisibleSelection::toNormalizedRange() const third_party/WebKit/Source/core/editing/VisibleSelection.cpp:260:9\n #4 0x7f1625917785 in blink::FrameSelection::toNormalizedRange() const third_party/WebKit/Source/core/editing/FrameSelection.h:169:70\n #5 0x7f1625ae0978 in blink::WebViewImpl::selectionBounds(blink::WebRect&, blink::WebRect&) const third_party/WebKit/Source/web/WebViewImpl.cpp:2548:51\n #6 0x7f163a01b67c in content::RenderWidget::GetSelectionBounds(gfx::Rect*, gfx::Rect*) content/renderer/render_widget.cc:1999:3\n #7 0x7f1639f5a7f8 in content::RenderViewImpl::GetSelectionBounds(gfx::Rect*, gfx::Rect*) content/renderer/render_view_impl.cc:3360:3\n #8 0x7f163a00e703 in content::RenderWidget::UpdateSelectionBounds() content/renderer/render_widget.cc:2015:5\n #9 0x7f163a00d2b2 in content::RenderWidget::WillBeginCompositorFrame() content/renderer/render_widget.cc:1386:3\n #10 0x7f1639a7378b in content::RenderWidgetCompositor::WillBeginMainFrame() content/renderer/gpu/render_widget_compositor.cc:829:3\n #11 0x7f1639a737e6 in non-virtual thunk to content::RenderWidgetCompositor::WillBeginMainFrame() content/renderer/gpu/render_widget_compositor.cc:828:30\n #12 0x7f1644c1c669 in cc::LayerTreeHost::WillBeginMainFrame() cc/trees/layer_tree_host.cc:198:3\n #13 0x7f1644e7aebd in cc::ThreadProxy::BeginMainFrame(scoped_ptr >) cc/trees/thread_proxy.cc:737:3\n #14 0x7f1644eaa5c2 in base::internal::RunnableAdapter >)>::Run(cc::ThreadProxy*, scoped_ptr >) base/bind_internal.h:176:12\n #15 0x7f1644eaa09a in base::internal::InvokeHelper >)>, base::internal::TypeList const&, scoped_ptr > > >::MakeItSo(base::internal::RunnableAdapter >)>, base::WeakPtr const&, scoped_ptr >) base/bind_internal.h:303:5\n #16 0x7f1644ea9dd8 in base::internal::Invoker, base::internal::BindState >)>, void (cc::ThreadProxy*, scoped_ptr >), base::internal::TypeList, base::internal::PassedWrapper > > > >, base::internal::TypeList >, base::internal::UnwrapTraits > > > >, base::internal::InvokeHelper >)>, base::internal::TypeList const&, scoped_ptr > > >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:343:12\n #17 0x7f1649c6f11e in base::Callback::Run() const base/callback.h:396:12\n #18 0x7f1649d0754c in base::debug::TaskAnnotator::RunTask(char const*, char const*, base::PendingTask const&) base/debug/task_annotator.cc:62:3\n #19 0x7f16545faef0 in scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(unsigned long, bool, base::PendingTask*) components/scheduler/child/task_queue_manager.cc:690:5\n #20 0x7f16545f508b in scheduler::TaskQueueManager::DoWork(bool) components/scheduler/child/task_queue_manager.cc:643:9\n #21 0x7f165464349d in base::internal::RunnableAdapter::Run(scheduler::TaskQueueManager*, bool const&) base/bind_internal.h:176:12\n #22 0x7f1654642fcf in base::internal::InvokeHelper, base::internal::TypeList const&, bool const&> >::MakeItSo(base::internal::RunnableAdapter, base::WeakPtr const&, bool const&) base/bind_internal.h:303:5\n #23 0x7f1654642d44 in base::internal::Invoker, base::internal::BindState, void (scheduler::TaskQueueManager*, bool), base::internal::TypeList, bool> >, base::internal::TypeList >, base::internal::UnwrapTraits >, base::internal::InvokeHelper, base::internal::TypeList const&, bool const&> >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:343:12\n #24 0x7f1649c6f11e in base::Callback::Run() const base/callback.h:396:12\n #25 0x7f1649d0754c in base::debug::TaskAnnotator::RunTask(char const*, char const*, base::PendingTask const&) base/debug/task_annotator.cc:62:3\n #26 0x7f1649efefdd in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:456:3\n #27 0x7f1649eff657 in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:466:5\n #28 0x7f1649f00c34 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:578:13\n #29 0x7f1649f2e99e in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:34:21\n #30 0x7f1649efda53 in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:422:3\n #31 0x7f164a088844 in base::RunLoop::Run() base/run_loop.cc:55:3\n #32 0x7f1649efb736 in base::MessageLoop::Run() base/message_loop/message_loop.cc:286:3\n #33 0x7f163a095acf in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:220:7\n #34 0x7f16350ff4c7 in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:308:14\n #35 0x7f16350ffd51 in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:392:12\n #36 0x7f16351084fd in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:808:12\n #37 0x7f16350fda84 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #38 0x50c7c6 in main content/shell/app/shell_main.cc:49:10\n #39 0x7f161d013ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-asan_linux-debug/revisions/asan-linux-debug-335874/lib/libblink_web.so+0xa3e925c)\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/assert_chromium_log.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_chromium_log.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/assert_chromium_log.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_chromium_log.txt.snap index 5c748044ec..5ba304799f 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/assert_chromium_log.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_chromium_log.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/assert_chromium_log.txt +--- { "text": "Command: ['/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-428862/base_json_correctness_fuzzer', '-max_len=9683', '-timeout=3595', '-rss_limit_mb=1024', '-max_total_time=2350', '-print_final_stats=1', '/mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases-disk/temp/new', '/mnt/scratch0/clusterfuzz/bot/inputs/fuzzers/libfuzzer/libfuzzer_data/base_json_correctness_fuzzer']\nBot: clusterfuzz-linux-pre-0381\nTime ran: 0.165543\n\nINFO: Seed: 2687657031\nINFO: Loaded 0 modules (0 guards):\nLoading corpus dir: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases-disk/temp/new\nLoading corpus dir: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzers/libfuzzer/libfuzzer_data/base_json_correctness_fuzzer\n#0\tREAD units: 413\n#413\tINITED cov: 987 bits: 2488 indir: 33 corp: 317/58Kb exec/s: 0 rss: 67Mb\n[1101/111812:FATAL:correctness_fuzzer.cc(51)] Assert failed: parsed_output == double_parsed_output. Parser/Writer mismatch.\nInput=\"\\\"trueGGu)u\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019(\\\\u0019\\\\u00199\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0000\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019uuuuuuuuuuuuuuuuuuuuuuuur;GyGGGGGGGGGGGGGGGGGuuuuuuuuuuuuuuuuur;GyGGGGGGGGGGGGGGGGGGyGGGGGGGGGGGGGGGGGGGGGGGGGKGGGGG\\\"\"\nOutput=\"\\\"trueGGu)u\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019(\\\\u0019\\\\u00199\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019\\\\u0019uuuuuuuuuuuuuuuuuuuuuuuur;GyGGGGGGGGGGGGGGGGGuuuuuuuuuuuuuuuuur;GyGGGGGGGGGGGGGGGGGGyGGGGGGGGGGGGGGGGGGGGGGGGGKGGGGG\\\"\"\n#0 0x00000046bef1 __interceptor_backtrace\n#1 0x000000579d06 base::debug::StackTrace::StackTrace()\n#2 0x000000536e6c logging::LogMessage::~LogMessage()\n#3 0x0000004f3cb6 LLVMFuzzerTestOneInput\n#4 0x00000050eef6 fuzzer::Fuzzer::ExecuteCallback()\n#5 0x00000050f3a0 fuzzer::Fuzzer::RunOne()\n#6 0x00000051105f fuzzer::Fuzzer::MutateAndTestOne()\n#7 0x000000511498 fuzzer::Fuzzer::Loop()\n#8 0x0000004f8606 fuzzer::FuzzerDriver()\n#9 0x000000515b99 main\n#10 0x7f4873ae0f45 __libc_start_main\n#11 0x00000042081d \n\nASAN:DEADLYSIGNAL\n=================================================================\n==11335==ERROR: AddressSanitizer: ABRT on unknown address 0x03e900002c47 (pc 0x7f4873af5c37 bp 0x7ffc18a25410 sp 0x7ffc18a252d8 T0)\nSCARINESS: 10 (signal)\n #0 0x7f4873af5c36 in gsignal /build/eglibc-oGUzwX/eglibc-2.19/signal/../nptl/sysdeps/unix/sysv/linux/raise.c:56\n #1 0x5374e5 in logging::LogMessage::~LogMessage() base/logging.cc:748:7\n #2 0x4f3cb5 in LLVMFuzzerTestOneInput base/json/correctness_fuzzer.cc:51:3\n #3 0x50eef5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:515:13\n #4 0x50f39f in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:469:3\n #5 0x51105e in fuzzer::Fuzzer::MutateAndTestOne() third_party/libFuzzer/src/FuzzerLoop.cpp:701:30\n #6 0x511497 in fuzzer::Fuzzer::Loop() third_party/libFuzzer/src/FuzzerLoop.cpp:734:5\n #7 0x4f8605 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:524:5\n #8 0x515b98 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10\n #9 0x7f4873ae0f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT /build/eglibc-oGUzwX/eglibc-2.19/signal/../nptl/sysdeps/unix/sysv/linux/raise.c:56 in gsignal\n==11335==ABORTING\nMS: 3 ChangeBinInt-InsertByte-InsertRepeatedBytes-; base unit: f5c4b4d152d846bfc80035b822d47d9b5b233734\n0x22,0x74,0x72,0x75,0x65,0x47,0x47,0x75,0x29,0x75,0x19,0x19,0x19,0x19,0x19,0x19,0x19,0x19,0x19,0x19,0x19,0x28,0x19,0x19,0x39,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x19,0x19,0x19,0x19,0x19,0x19,0x19,0x19,0x19,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x72,0x3b,0x47,0x79,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x75,0x72,0x3b,0x47,0x79,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x79,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x47,0x4b,0x47,0x47,0x47,0x47,0x47,0x22,0x62,\n\\\"trueGGu)u\\x19\\x19\\x19\\x19\\x19\\x19\\x19\\x19\\x19\\x19\\x19(\\x19\\x199\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x19\\x19\\x19\\x19\\x19\\x19\\x19\\x19uuuuuuuuuuuuuuuuuuuuuuuur;GyGGGGGGGGGGGGGGGGGuuuuuuuuuuuuuuuuur;GyGGGGGGGGGGGGGGGGGGyGGGGGGGGGGGGGGGGGGGGGGGGGKGGGGG\\\"b\nartifact_prefix='./'; Test unit written to ./crash-a3f8c1ab8aa1486c8f0631eba08eece7a73bbbf8\nBase64: InRydWVHR3UpdRkZGRkZGRkZGRkZKBkZOQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGRkZGRkZGRkZdXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1cjtHeUdHR0dHR0dHR0dHR0dHR0dHdXV1dXV1dXV1dXV1dXV1dXVyO0d5R0dHR0dHR0dHR0dHR0dHR0dHeUdHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dLR0dHR0ciYg==\nstat::number_of_executed_units: 521\nstat::average_exec_per_sec: 0\nstat::new_units_added: 0\nstat::slowest_unit_time_sec: 0\nstat::peak_rss_mb: 67\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/assert_failure_google.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_failure_google.txt.snap similarity index 96% rename from src/agent/libclusterfuzz/data/parsed-traces/assert_failure_google.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_failure_google.txt.snap index 7d22b13e74..1c3cd39fae 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/assert_failure_google.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_failure_google.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/assert_failure_google.txt +--- { "text": "F0812 21:22:15.159294 61315 logging.cc:89] assert.h assertion failed at file/path.cc:380 in Foo: Blah.empty() && \"Failure!\"\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==61315==ERROR: AddressSanitizer: ABRT on unknown address 0x05390000ef83 (pc 0x7fd6607ef602 bp 0x7ffc9d927900 sp 0x7ffc9d9277d8 T0)\nSCARINESS: 10 (signal)\n #0 0x7fd6607ef601 in raise (/usr/grte/v4/lib64/libc.so.6+0xfffff)\n #1 0x7fd6607f131f in abort (/usr/grte/v4/lib64/libc.so.6+0xfffff)\n #12 0x561b33363be6 in Frame(int) file/path.cc:48:11\n #13 0x561b33360f41 in LLVMFuzzerTestOneInput file/path.cc:23:3\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/assert_glibc.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_glibc.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/assert_glibc.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_glibc.txt.snap index 33b9cfa11e..e1acfac7cc 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/assert_glibc.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_glibc.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/assert_glibc.txt +--- { "text": "chewing_default_fuzzer: tree.c:860: RecordNode *DuplicateRecordAndInsertInterval(const RecordNode *, TreeDataType *, const int): Assertion `record failed.\nASAN:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7faed4efa418 bp 0x000000734960 sp 0x7ffc43b364e8 T0)\nSCARINESS: 10 (signal)\n#0 0x7faed4efa417 in gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x35417)\n#1 0x7faed4efc019 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x37019)\n#0 0x7faed4ef2bd6 in libc.so.6\n#3 0x7faed4ef2c81 in __assert_fail (/lib/x86_64-linux-gnu/libc.so.6+0x2dc81)\n#4 0x550d27 in DuplicateRecordAndInsertInterval /src/libchewing/src/tree.c:860:5\n#5 0x5490c1 in DoDpPhrasing /src/libchewing/src/tree.c:977:19\n#6 0x5447a9 in Phrasing /src/libchewing/src/tree.c:1019:9\n#7 0x532cfc in CallPhrasing /src/libchewing/src/chewingutil.c:746:5\n#8 0x51ca3c in chewing_handle_Default /src/libchewing/src/chewingio.c:1601:9\n#9 0x51aaaf in chewing_handle_Space /src/libchewing/src/chewingio.c:811:16\n#10 0x50fd2d in type_single_keystroke /src/libchewing/test/testhelper.c:174:13\n#11 0x50ed82 in stress_main /src/libchewing/test/stress.c:222:7\n#12 0x50ce27 in LLVMFuzzerTestOneInput /src/chewing_default_fuzzer.c:12:3\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/assert_glibc_with_glib.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_glibc_with_glib.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/assert_glibc_with_glib.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_glibc_with_glib.txt.snap index 80f24ce2d7..6f4d43d14a 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/assert_glibc_with_glib.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_glibc_with_glib.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/assert_glibc_with_glib.txt +--- { "text": "CRITICAL ERROR : gst_vorbis_tag_add: assertion 'g_utf8_validate (tag, -1, NULL)' failed\nUndefinedBehaviorSanitizer:DEADLYSIGNAL\n==1==ERROR: UndefinedBehaviorSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7f15a7835428 bp 0x7f15a537b040 sp 0x7f15a537aef8 T3)\n #0 0x7f15a7835427 in gsignal /build/glibc-9tT8Do/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54\n #1 0x7f15a7837029 in abort /build/glibc-9tT8Do/glibc-2.23/stdlib/abort.c:89\n #2 0x42fa49 in custom_logger /src/gst-ci/fuzzing/gst-discoverer.c:79:5\n #3 0x7264cc in g_logv /work/glib-2.54.2/glib/gmessages.c:1341:11\n #4 0x726117 in g_log /work/glib-2.54.2/glib/gmessages.c:1403:3\n #5 0x5a0a50 in gst_tag_list_from_vorbiscomment /src/gst-plugins-base/gst-libs/gst/tag/gstvorbistag.c:484:7\n #6 0x50438b in tag_list_from_vorbiscomment_packet /src/gst-plugins-base/ext/ogg/gstoggstream.c:385:10\n #7 0x502c71 in extract_tags_opus /src/gst-plugins-base/ext/ogg/gstoggstream.c:2108:5\n #8 0x4f0bd0 in gst_ogg_pad_submit_packet /src/gst-plugins-base/ext/ogg/gstoggdemux.c:1129:5\n #9 0x4efa99 in gst_ogg_pad_stream_out /src/gst-plugins-base/ext/ogg/gstoggdemux.c:1289:18\n #10 0x4ee877 in gst_ogg_pad_submit_page /src/gst-plugins-base/ext/ogg/gstoggdemux.c:2032:12\n #11 0x4f203b in gst_ogg_demux_handle_page /src/gst-plugins-base/ext/ogg/gstoggdemux.c:4547:14\n #12 0x4f19f2 in gst_ogg_demux_chain /src/gst-plugins-base/ext/ogg/gstoggdemux.c:4626:16\n #13 0x6270cc in gst_pad_chain_data_unchecked /src/gstreamer/gst/gstpad.c:0:35\n #14 0x627c69 in gst_pad_push_data /src/gstreamer/gst/gstpad.c:4471:9\n #15 0x6279a1 in gst_pad_push /src/gstreamer/gst/gstpad.c:4590:9\n #16 0x45bf43 in stop_typefinding /src/gstreamer/plugins/elements/gsttypefindelement.c:645:7\n #17 0x45c2c1 in gst_type_find_element_chain_do_typefinding /src/gstreamer/plugins/elements/gsttypefindelement.c:979:3\n #18 0x45ab29 in gst_type_find_element_sink_event /src/gstreamer/plugins/elements/gsttypefindelement.c:702:11\n #19 0x62af31 in gst_pad_send_event_unchecked /src/gstreamer/gst/gstpad.c:5633:14\n #20 0x62a872 in gst_pad_push_event_unchecked /src/gstreamer/gst/gstpad.c:5289:9\n #21 0x62deef in push_sticky /src/gstreamer/gst/gstpad.c:3817:17\n #22 0x625e8b in events_foreach /src/gstreamer/gst/gstpad.c:604:11\n #23 0x626d6b in check_sticky /src/gstreamer/gst/gstpad.c:3874:5\n #24 0x62a2b9 in gst_pad_push_event /src/gstreamer/gst/gstpad.c:5420:12\n #25 0x6253f9 in event_forward_func /src/gstreamer/gst/gstpad.c:2992:19\n #26 0x625165 in gst_pad_forward /src/gstreamer/gst/gstpad.c:2946:25\n #27 0x625377 in gst_pad_event_default /src/gstreamer/gst/gstpad.c:3043:5\n #28 0x62af31 in gst_pad_send_event_unchecked /src/gstreamer/gst/gstpad.c:5633:14\n #29 0x62a872 in gst_pad_push_event_unchecked /src/gstreamer/gst/gstpad.c:5289:9\n #30 0x62deef in push_sticky /src/gstreamer/gst/gstpad.c:3817:17\n #31 0x625e8b in events_foreach /src/gstreamer/gst/gstpad.c:604:11\n #32 0x626d6b in check_sticky /src/gstreamer/gst/gstpad.c:3874:5\n #33 0x62a2b9 in gst_pad_push_event /src/gstreamer/gst/gstpad.c:5420:12\n #34 0x5be78c in gst_base_src_loop /src/gstreamer/libs/gst/base/gstbasesrc.c:3002:7\n #35 0x65a3f1 in gst_task_func /src/gstreamer/gst/gsttask.c:332:5\n #36 0x752c72 in g_thread_pool_thread_proxy /work/glib-2.54.2/glib/gthreadpool.c:307:15\n #37 0x751667 in g_thread_proxy /work/glib-2.54.2/glib/gthread.c:784:20\n #38 0x7f15a7de66b9 in start_thread\n #39 0x7f15a790682c in clone /build/glibc-9tT8Do/glibc-2.23/sysdeps/unix/sysv/linux/x86_64/clone.S:109\n\nUndefinedBehaviorSanitizer can not provide additional info.\nSUMMARY: UndefinedBehaviorSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x35427)\n==1==ABORTING\n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/assert_with_panic_keyword.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_with_panic_keyword.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/assert_with_panic_keyword.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_with_panic_keyword.txt.snap index 3d721dd727..62b0f03106 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/assert_with_panic_keyword.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@assert_with_panic_keyword.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/assert_with_panic_keyword.txt +--- { "text": "[Environment] ASAN_OPTIONS = redzone=32:strict_string_check=1:symbolize=0:handle_sigill=1:handle_segv=1:allocator_release_to_os_interval_ms=500:print_suppressions=0:strict_memcmp=1:allow_user_segv_handler=0:coverage=0:allocator_may_return_null=1:fast_unwind_on_fatal=0:handle_sigfpe=1:handle_sigbus=1:detect_stack_use_after_return=1:alloc_dealloc_mismatch=0:detect_leaks=1:print_scariness=1:strip_path_prefix=/workspace/:max_uar_stack_size_log=16:handle_abort=1:check_malloc_usable_size=0:detect_container_overflow=1:quarantine_size_mb=256:detect_odr_violation=0:use_sigaltstack=1:print_summary=1\n[Command line] python /mnt/scratch0/clusterfuzz/src/python/bot/fuzzers/libFuzzer/launcher.py /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/0b57a7d43fabfa98de384327db6408f031843fe4c1f3bf8f33c178e7e3fuzz-1 config_fuzz_test /mnt/scratch0/clusterfuzz/bot/inputs/data-bundles/global/envoy_config_fuzz_test -timeout=25 -rss_limit_mb=2048\n+----------------------------------------Release Build Stacktrace----------------------------------------+\nRunning command: /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test -timeout=25 -rss_limit_mb=2048 -runs=100 /3ceec645ca617fd98de10638a403ff7f31843fe4c1f3bf8f33c178e7e3fuzz-1\nINFO: Seed: 227034424\nINFO: Loaded 1 modules (504300 inline 8-bit counters): 504300 [0x4539a10, 0x45b4bfc),\nINFO: Loaded 1 PC tables (504300 PCs): 504300 [0x45b4c00,0x4d66ac0),\n/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test: Running 1 inputs 100 time(s) each.\nRunning: /3ceec645ca617fd98de10638a403ff7f31843fe4c1f3bf8f33c178e7e3fuzz-1\n[libprotobuf WARNING external/com_google_protobuf/src/google/protobuf/text_format.cc:324] Warning parsing text-format envoy.config.bootstrap.v2.Bootstrap: 13:1: text format contains deprecated field \"deprecated_v1\"\n[libprotobuf WARNING external/com_google_protobuf/src/google/protobuf/text_format.cc:324] Warning parsing text-format envoy.config.bootstrap.v2.Bootstrap: 13:1: text format contains deprecated field \"deprecated_v1\"\n[2018-09-20 01:00:45.516][1][critical][assert] source/common/upstream/cluster_manager_impl.cc:259] panic: not reached\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7f37f8b21428 bp 0x7ffed2d1cf90 sp 0x7ffed2d1cce8 T0)\nSCARINESS: 10 (signal)\n #0 0x7f37f8b21427 in gsignal /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54\n #1 0x7f37f8b23029 in abort /build/glibc-Cl5G7W/glibc-2.23/stdlib/abort.c:89\n #2 0x8295ea in Envoy::Upstream::ClusterManagerImpl::ClusterManagerImpl(envoy::config::bootstrap::v2::Bootstrap const&, Envoy::Upstream::ClusterManagerFactory&, Envoy::Stats::Store&, Envoy::ThreadLocal::Instance&, Envoy::Runtime::Loader&, Envoy::Runtime::RandomGenerator&, Envoy::LocalInfo::LocalInfo const&, Envoy::AccessLog::AccessLogManager&, Envoy::Event::Dispatcher&, Envoy::Server::Admin&) /source/common/upstream/cluster_manager_impl.cc:259:7\n #3 0x66356c in Envoy::Upstream::ValidationClusterManager::ValidationClusterManager(envoy::config::bootstrap::v2::Bootstrap const&, Envoy::Upstream::ClusterManagerFactory&, Envoy::Stats::Store&, Envoy::ThreadLocal::Instance&, Envoy::Runtime::Loader&, Envoy::Runtime::RandomGenerator&, Envoy::LocalInfo::LocalInfo const&, Envoy::AccessLog::AccessLogManager&, Envoy::Event::Dispatcher&, Envoy::Server::Admin&) /source/server/config_validation/cluster_manager.cc:41:7\n #4 0x6632d9 in Envoy::Upstream::ValidationClusterManagerFactory::clusterManagerFromProto(envoy::config::bootstrap::v2::Bootstrap const&, Envoy::Stats::Store&, Envoy::ThreadLocal::Instance&, Envoy::Runtime::Loader&, Envoy::Runtime::RandomGenerator&, Envoy::LocalInfo::LocalInfo const&, Envoy::AccessLog::AccessLogManager&, Envoy::Server::Admin&) /source/server/config_validation/cluster_manager.cc:21:32\n #5 0x1df71c7 in Envoy::Server::Configuration::MainImpl::initialize(envoy::config::bootstrap::v2::Bootstrap const&, Envoy::Server::Instance&, Envoy::Upstream::ClusterManagerFactory&) /source/server/configuration_impl.cc:57:46\n #6 0x659f24 in Envoy::Server::ValidationInstance::initialize(Envoy::Server::Options&, std::__1::shared_ptr, Envoy::Server::ComponentFactory&) /source/server/config_validation/server.cc:93:16\n #7 0x658384 in Envoy::Server::ValidationInstance::ValidationInstance(Envoy::Server::Options&, Envoy::Event::TimeSystem&, std::__1::shared_ptr, Envoy::Stats::IsolatedStoreImpl&, Envoy::Thread::BasicLockable&, Envoy::Server::ComponentFactory&) /source/server/config_validation/server.cc:49:5\n #8 0x657071 in Envoy::Server::validateConfig(Envoy::Server::Options&, std::__1::shared_ptr, Envoy::Server::ComponentFactory&) /source/server/config_validation/server.cc:27:24\n #9 0x636f65 in Envoy::Server::TestOneProtoInput(envoy::config::bootstrap::v2::Bootstrap const&) /test/server/config_validation/config_fuzz_test.cc:29:5\n #10 0x6368e4 in LLVMFuzzerTestOneInput /test/server/config_validation/config_fuzz_test.cc:16:1\n #11 0x2da0578 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:570:15\n #12 0x2d7df6d in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6\n #13 0x2d897e3 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9\n #14 0x2d7d5ec in main /src/libfuzzer/FuzzerMain.cpp:20:10\n #15 0x7f37f8b0c82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291\n #16 0x522da8 in _start\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x35427)\n==1==ABORTING\n+----------------------------------------Release Build Unsymbolized Stacktrace (diff)----------------------------------------+\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7f37f8b21428 bp 0x7ffed2d1cf90 sp 0x7ffed2d1cce8 T0)\nSCARINESS: 10 (signal)\n #0 0x7f37f8b21427 (/lib/x86_64-linux-gnu/libc.so.6+0x35427)\n #1 0x7f37f8b23029 (/lib/x86_64-linux-gnu/libc.so.6+0x37029)\n #2 0x8295ea (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x8295ea)\n #3 0x66356c (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x66356c)\n #4 0x6632d9 (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x6632d9)\n #5 0x1df71c7 (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x1df71c7)\n #6 0x659f24 (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x659f24)\n #7 0x658384 (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x658384)\n #8 0x657071 (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x657071)\n #9 0x636f65 (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x636f65)\n #10 0x6368e4 (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x6368e4)\n #11 0x2da0578 (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x2da0578)\n #12 0x2d7df6d (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x2d7df6d)\n #13 0x2d897e3 (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x2d897e3)\n #14 0x2d7d5ec (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x2d7d5ec)\n #15 0x7f37f8b0c82f (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\n #16 0x522da8 (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_envoy_13d8ff3fd8b6e12ff5bbd32d951c40c9e1c6513f/revisions/config_fuzz_test+0x522da8)", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/browser_uaf.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@browser_uaf.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/browser_uaf.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@browser_uaf.txt.snap index 7ff04b0a71..e6d6ff828b 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/browser_uaf.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@browser_uaf.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/browser_uaf.txt +--- { "text": "\n=================================================================\n==14363==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000129b40 at pc 0x7f8dd3de9d09 bp 0x7f8c4dedd5c0 sp 0x7f8c4dedd5b8\nREAD of size 8 at 0x612000129b40 thread T30 (MidiSendThread)\n #0 0x7f8dd3de9d08 in base::internal::RunnableAdapter::Run(media::midi::MidiManagerClient*, unsigned long const&) base/bind_internal.h:178:12\n #1 0x7f8dd3de99de in base::internal::InvokeHelper, base::internal::TypeList >::MakeItSo(base::internal::RunnableAdapter, media::midi::MidiManagerClient*, unsigned long const&) base/bind_internal.h:295:5\n #2 0x7f8dc3c20537 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #3 0x7f8dc3aa9b59 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:482:3\n #4 0x7f8dc3aaa8ed in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:491:5\n #5 0x7f8dc3aaaf42 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:603:13\n #6 0x7f8dc3ab7c15 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:32:21\n #7 0x7f8dc3aa9035 in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:446:3\n #8 0x7f8dc3b062a4 in base::RunLoop::Run() base/run_loop.cc:55:3\n #9 0x7f8dc3aa65d8 in base::MessageLoop::Run() base/message_loop/message_loop.cc:289:3\n #10 0x7f8dc3ba2c07 in base::Thread::ThreadMain() base/threading/thread.cc:251:3\n #11 0x7f8dc3b8ed9c in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:64:3\n #12 0x7f8db9013181 in start_thread /build/buildd/eglibc-2.19/nptl/pthread_create.c:312\n0x612000129b40 is located 64 bytes inside of 256-byte region [0x612000129b00,0x612000129c00)\nfreed by thread T15 (Chrome_IOThread) here:\n #0 0x7f8dc2627d2b in operator delete(void*)\n #1 0x7f8dcd81cbab in void content::BrowserThread::DeleteOnThread<(content::BrowserThread::ID)6>::Destruct(content::MidiHost const*) content/public/browser/browser_thread.h:257:9\n #2 0x7f8dc2670924 in base::RefCountedThreadSafe::Release() const base/memory/ref_counted.h:184:7\n #3 0x7f8dccaab52c in scoped_refptr::~scoped_refptr() base/memory/ref_counted.h:298:7\n #4 0x7f8dccaabac9 in base::internal::BindState, void (content::BrowserMessageFilter*, IPC::Message*), base::internal::TypeList >::Destroy(base::internal::BindStateBase*) base/bind_internal.h:417:5\n #5 0x7f8dc3a0d98a in base::internal::BindStateBase::Release() base/callback_internal.cc:18:5\n #6 0x7f8dc3a0dfbc in scoped_refptr::~scoped_refptr() base/memory/ref_counted.h:298:7\n #7 0x7f8dc3addbbb in base::PendingTask::~PendingTask() base/pending_task.cc:34:1\n #8 0x7f8dc3aab13d in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:606:5\n #9 0x7f8dc39f33fb in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_libevent.cc:237:21\n #10 0x7f8dc3aa9035 in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:446:3\n #11 0x7f8dc3b062a4 in base::RunLoop::Run() base/run_loop.cc:55:3\n #12 0x7f8dc3aa65d8 in base::MessageLoop::Run() base/message_loop/message_loop.cc:289:3\n #13 0x7f8dccb35f35 in content::BrowserThreadImpl::IOThreadRun(base::MessageLoop*) content/browser/browser_thread_impl.cc:211:3\n #14 0x7f8dccb3633e in content::BrowserThreadImpl::Run(base::MessageLoop*) content/browser/browser_thread_impl.cc:246:14\n #15 0x7f8dc3ba2c07 in base::Thread::ThreadMain() base/threading/thread.cc:251:3\n #16 0x7f8dc3b8ed9c in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:64:3\n #17 0x7f8db9013181 in start_thread /build/buildd/eglibc-2.19/nptl/pthread_create.c:312\n\npreviously allocated by thread T0 (chrome) here:\n #0 0x7f8dc262776b in operator new(unsigned long)\n #1 0x7f8dcce834e1 in content::RenderProcessHostImpl::CreateMessageFilters() content/browser/renderer_host/render_process_host_impl.cc:898:7\n #2 0x7f8dcce819e5 in content::RenderProcessHostImpl::Init() content/browser/renderer_host/render_process_host_impl.cc:721:3\n #3 0x7f8dccc852af in content::RenderFrameHostManager::InitRenderView(content::RenderViewHostImpl*, content::RenderFrameProxyHost*) content/browser/frame_host/render_frame_host_manager.cc:2028:8\n #4 0x7f8dccc8333d in content::RenderFrameHostManager::Navigate(GURL const&, content::FrameNavigationEntry const&, content::NavigationEntryImpl const&) content/browser/frame_host/render_frame_host_manager.cc:421:10\n #5 0x7f8dcd6958d1 in content::NavigatorImpl::NavigateToEntry(content::FrameTreeNode*, content::FrameNavigationEntry const&, content::NavigationEntryImpl const&, content::NavigationController::ReloadType, bool, bool) content/browser/frame_host/navigator_impl.cc:315:7\n #6 0x7f8dcd697736 in content::NavigatorImpl::NavigateToPendingEntry(content::FrameTreeNode*, content::FrameNavigationEntry const&, content::NavigationController::ReloadType, bool) content/browser/frame_host/navigator_impl.cc:393:10\n #7 0x7f8dccc1cc62 in content::NavigationControllerImpl::NavigateToPendingEntryInternal(content::NavigationController::ReloadType) content/browser/frame_host/navigation_controller_impl.cc:1796:12\n #8 0x7f8dccc0ca69 in content::NavigationControllerImpl::NavigateToPendingEntry(content::NavigationController::ReloadType) content/browser/frame_host/navigation_controller_impl.cc:1773:18\n #9 0x7f8dccc0db19 in content::NavigationControllerImpl::LoadEntry(scoped_ptr >) content/browser/frame_host/navigation_controller_impl.cc:441:3\n #10 0x7f8dccc1146b in content::NavigationControllerImpl::LoadURLWithParams(content::NavigationController::LoadURLParams const&) content/browser/frame_host/navigation_controller_impl.cc:806:3\n #11 0x7f8dcc04ef7c in (anonymous namespace)::LoadURLInContents(content::WebContents*, GURL const&, chrome::NavigateParams*) chrome/browser/ui/browser_navigator.cc:290:3\n #12 0x7f8dcc04b0af in chrome::Navigate(chrome::NavigateParams*) chrome/browser/ui/browser_navigator.cc:547:9\n #13 0x7f8dcc0b851d in StartupBrowserCreatorImpl::OpenTabsInBrowser(Browser*, bool, std::__1::vector > const&, chrome::HostDesktopType) chrome/browser/ui/startup/startup_browser_creator_impl.cc:774:5\n #14 0x7f8dcc0b4f74 in StartupBrowserCreatorImpl::ProcessSpecifiedURLs(std::__1::vector > const&, chrome::HostDesktopType) chrome/browser/ui/startup/startup_browser_creator_impl.cc:693:22\n #15 0x7f8dcc0b3f85 in StartupBrowserCreatorImpl::ProcessStartupURLs(std::__1::vector > const&, chrome::HostDesktopType) chrome/browser/ui/startup/startup_browser_creator_impl.cc:629:22\n #16 0x7f8dcc0b2309 in StartupBrowserCreatorImpl::ProcessLaunchURLs(bool, std::__1::vector > const&, chrome::HostDesktopType) chrome/browser/ui/startup/startup_browser_creator_impl.cc:515:26\n #17 0x7f8dcc0b0c16 in StartupBrowserCreatorImpl::Launch(Profile*, std::__1::vector > const&, bool, chrome::HostDesktopType) chrome/browser/ui/startup/startup_browser_creator_impl.cc:348:5\n #18 0x7f8dcc0a7e6d in StartupBrowserCreator::LaunchBrowser(base::CommandLine const&, Profile*, base::FilePath const&, chrome::startup::IsProcessStartup, chrome::startup::IsFirstRun) chrome/browser/ui/startup/startup_browser_creator.cc:382:27\n #19 0x7f8dcc0a6ee2 in StartupBrowserCreator::ProcessCmdLineImpl(base::CommandLine const&, base::FilePath const&, bool, Profile*, std::__1::vector > const&, StartupBrowserCreator*) chrome/browser/ui/startup/startup_browser_creator.cc:832:12\n #20 0x7f8dcc0a5658 in StartupBrowserCreator::Start(base::CommandLine const&, base::FilePath const&, Profile*, std::__1::vector > const&) chrome/browser/ui/startup/startup_browser_creator.cc:326:10\n #21 0x7f8dc3052bf4 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:1694:24\n #22 0x7f8dc3050fb7 in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1122:18\n #23 0x7f8dcd4a4588 in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:943:5\n #24 0x7f8dcd4ae631 in base::internal::InvokeHelper, base::internal::TypeList >::MakeItSo(base::internal::RunnableAdapter, content::BrowserMainLoop*) base/bind_internal.h:288:12\n #25 0x7f8dcda6f7ce in content::StartupTaskRunner::RunAllTasksNow() content/browser/startup_task_runner.cc:45:14\n #26 0x7f8dcd4a13d1 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:821:3\n #27 0x7f8dccb2fd99 in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams const&) content/browser/browser_main_runner.cc:220:5\n #28 0x7f8dccb2e7a7 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:40:19\n #29 0x7f8dc3953b07 in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:378:14\n #30 0x7f8dc3956691 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:786:12\n #31 0x7f8dc3951be1 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #32 0x7f8dc26298f9 in ChromeMain chrome/app/chrome_main.cc:66:12\n #33 0x7f8db7a30ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\n\nThread T30 (MidiSendThread) created by T15 (Chrome_IOThread) here:\n #0 0x7f8dc25e7789 in __interceptor_pthread_create\n #1 0x7f8dc3b8dfc3 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) base/threading/platform_thread_posix.cc:103:13\n #2 0x7f8dc3ba1c28 in base::Thread::StartWithOptions(base::Thread::Options const&) base/threading/thread.cc:113:10\n #3 0x7f8dc3ba197e in base::Thread::Start() base/threading/thread.cc:83:10\n #4 0x7f8dd3dd0545 in media::midi::MidiManagerAlsa::DispatchSendMidiData(media::midi::MidiManagerClient*, unsigned int, std::__1::vector > const&, double) media/midi/midi_manager_alsa.cc:285:5\n #5 0x7f8dcd81da5f in content::MidiHost::OnSendData(unsigned int, std::__1::vector > const&, double) content/browser/media/midi_host.cc:127:5\n #6 0x7f8dcd81d3f3 in bool MidiHostMsg_SendData::Dispatch > const&, double)>(IPC::Message const*, content::MidiHost*, content::MidiHost*, void*, void (content::MidiHost::*)(unsigned int, std::__1::vector > const&, double)) content/common/media/midi_messages.h:38:1\n #7 0x7f8dcd81cf79 in content::MidiHost::OnMessageReceived(IPC::Message const&) content/browser/media/midi_host.cc:77:5\n #8 0x7f8dccaa98e9 in content::BrowserMessageFilter::Internal::OnMessageReceived(IPC::Message const&) content/public/browser/browser_message_filter.cc:67:14\n #9 0x7f8dc639992a in IPC::(anonymous namespace)::TryFiltersImpl(std::__1::vector >&, IPC::Message const&) ipc/message_filter_router.cc:20:9\n #10 0x7f8dc6399753 in IPC::MessageFilterRouter::TryFilters(IPC::Message const&) ipc/message_filter_router.cc:85:10\n #11 0x7f8dc6364839 in IPC::ChannelProxy::Context::TryFilters(IPC::Message const&) ipc/ipc_channel_proxy.cc:73:7\n #12 0x7f8dc6364de1 in IPC::ChannelProxy::Context::OnMessageReceived(IPC::Message const&) ipc/ipc_channel_proxy.cc:90:8\n #13 0x7f8dc63718dd in IPC::internal::ChannelReader::DispatchMessage(IPC::Message*) ipc/ipc_channel_reader.cc:76:3\n #14 0x7f8dc63727f2 in IPC::internal::ChannelReader::HandleExternalMessage(IPC::Message*, std::__1::vector > const&) ipc/ipc_channel_reader.cc:205:7\n #15 0x7f8dc6372302 in IPC::internal::ChannelReader::HandleTranslatedMessage(IPC::Message*, std::__1::vector > const&) ipc/ipc_channel_reader.cc:186:10\n #16 0x7f8dc637023d in IPC::internal::ChannelReader::TranslateInputData(char const*, int) ipc/ipc_channel_reader.cc:107:12\n #17 0x7f8dc636fc07 in IPC::internal::ChannelReader::ProcessIncomingMessages() ipc/ipc_channel_reader.cc:40:10\n #18 0x7f8dc6357190 in IPC::ChannelPosix::OnFileCanReadWithoutBlocking(int) ipc/ipc_channel_posix.cc:667:9\n #19 0x7f8dc39f02b3 in base::MessagePumpLibevent::FileDescriptorWatcher::OnFileCanReadWithoutBlocking(int, base::MessagePumpLibevent*) base/message_loop/message_pump_libevent.cc:104:3\n #20 0x7f8dc39f1c1e in base::MessagePumpLibevent::OnLibeventNotification(int, short, void*) base/message_loop/message_pump_libevent.cc:372:5\n #21 0x7f8dc3cb27be in event_process_active third_party/libevent/event.c:388:4\n #22 0x7f8dc3cb0bbe in event_base_loop third_party/libevent/event.c:540:4\n #23 0x7f8dc39f3304 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_libevent.cc:274:9\n #24 0x7f8dc3aa9035 in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:446:3\n #25 0x7f8dc3b062a4 in base::RunLoop::Run() base/run_loop.cc:55:3\n #26 0x7f8dc3aa65d8 in base::MessageLoop::Run() base/message_loop/message_loop.cc:289:3\n #27 0x7f8dccb35f35 in content::BrowserThreadImpl::IOThreadRun(base::MessageLoop*) content/browser/browser_thread_impl.cc:211:3\n #28 0x7f8dccb3633e in content::BrowserThreadImpl::Run(base::MessageLoop*) content/browser/browser_thread_impl.cc:246:14\n #29 0x7f8dc3ba2c07 in base::Thread::ThreadMain() base/threading/thread.cc:251:3\n #30 0x7f8dc3b8ed9c in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:64:3\n #31 0x7f8db9013181 in start_thread /build/buildd/eglibc-2.19/nptl/pthread_create.c:312\n\nThread T15 (Chrome_IOThread) created by T0 (chrome) here:\n #0 0x7f8dc25e7789 in __interceptor_pthread_create\n #1 0x7f8dc3b8dfc3 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) base/threading/platform_thread_posix.cc:103:13\n #2 0x7f8dc3ba1c28 in base::Thread::StartWithOptions(base::Thread::Options const&) base/threading/thread.cc:113:10\n #3 0x7f8dccb36cbe in content::BrowserThreadImpl::StartWithOptions(base::Thread::Options const&) content/browser/browser_thread_impl.cc:301:10\n #4 0x7f8dcd4a21f3 in content::BrowserMainLoop::CreateThreads() content/browser/browser_main_loop.cc:912:12\n #5 0x7f8dcd4ae631 in base::internal::InvokeHelper, base::internal::TypeList >::MakeItSo(base::internal::RunnableAdapter, content::BrowserMainLoop*) base/bind_internal.h:288:12\n #6 0x7f8dcda6f7ce in content::StartupTaskRunner::RunAllTasksNow() content/browser/startup_task_runner.cc:45:14\n #7 0x7f8dcd4a13d1 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:821:3\n #8 0x7f8dccb2fd99 in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams const&) content/browser/browser_main_runner.cc:220:5\n #9 0x7f8dccb2e7a7 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:40:19\n #10 0x7f8dc3953b07 in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:378:14\n #11 0x7f8dc3956691 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:786:12\n #12 0x7f8dc3951be1 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #13 0x7f8dc26298f9 in ChromeMain chrome/app/chrome_main.cc:66:12\n #14 0x7f8db7a30ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-asan_linux-release_4392242b7f59878a2775b4607420a2b37e17ff13/symbolized/release/asan-symbolized-linux-release-363079/chrome+0x143e8d08)\nShadow bytes around the buggy address:\n 0x0c248001d310: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa\n 0x0c248001d320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c248001d330: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c248001d340: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa\n 0x0c248001d350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n=>0x0c248001d360: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd\n 0x0c248001d370: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c248001d380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c248001d390: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c248001d3a0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa\n 0x0c248001d3b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap left redzone: fa\n Heap right redzone: fb\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack partial redzone: f4\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n==14363==ABORTING\n\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/browser_uaf2.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@browser_uaf2.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/browser_uaf2.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@browser_uaf2.txt.snap index 501abcee50..85cb585726 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/browser_uaf2.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@browser_uaf2.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/browser_uaf2.txt +--- { "text": "==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f00003b280 at pc 0x7efd4a2a3e03 bp 0x7ffd1ed50680 sp 0x7ffd1ed50678\npreviously allocated by thread T0 (chrome) here:\n #0 0xe9e9e9e9e955 in base::Thread::StartWithOptions(base::Thread::Options const&) base/threading/thread.cc:119:15\n #1 0xe9e9e9e9e9e5 in content::BrowserProcessSubThread::CreateIOThread() content/browser/browser_process_sub_thread.cc:92:19\n #2 0xe9e9e9e9e9c0 in content::ContentMainRunnerImpl::RunServiceManager(content::MainFunctionParams&, bool) content/app/content_main_runner_impl.cc:962:31\n #3 0xe9e9e9e9e95b in content::ContentMainRunnerImpl::Run(bool) content/app/content_main_runner_impl.cc:878:12\n #4 0xe9e9e9e9e948 in service_manager::Main(service_manager::MainParams const&) services/service_manager/embedder/main.cc:416:29\n #5 0xe9e9e9e9e9bc in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:10\n #6 0xe9e9e9e9e90e in ChromeMain chrome/app/chrome_main.cc:103:12\n #7 0xe9e9e9e9e92f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-asan_linux-release_4392242b7f59878a2775b4607420a2b37e17ff13/symbolized/release/asan-symbolized-linux-release-365513/chrome+0xa091e02)\nShadow bytes around the buggy address:\n 0x0c1e7ffff600: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c1e7ffff610: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fa\n 0x0c1e7ffff620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c1e7ffff630: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa\n 0x0c1e7ffff640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fd fd\n=>0x0c1e7ffff650:[fd]fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa\n 0x0c1e7ffff660: fa fa fa fa fa fa fa fa fa fa fa fa fd fd fd fd\n 0x0c1e7ffff670: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa\n 0x0c1e7ffff680: fa fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00\n 0x0c1e7ffff690: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa\n 0x0c1e7ffff6a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap left redzone: fa\n Heap right redzone: fb\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack partial redzone: f4\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/browser_uaf3.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@browser_uaf3.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/browser_uaf3.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@browser_uaf3.txt.snap index ee3836ede6..3090f7de33 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/browser_uaf3.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@browser_uaf3.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/browser_uaf3.txt +--- { "text": "==9152==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000105688 at pc 0x5582ff46a32d bp 0x7f95382ce910 sp 0x7f95382ce908\nREAD of size 4 at 0x614000105688 thread T14 (TaskSchedulerFo)\nSCARINESS: 45 (4-byte-read-heap-use-after-free)\nThread T4 (TaskSchedulerFo) created by T0 (chrome) here:\n #0 0x5582f45f0f6a in __interceptor_pthread_create /b/swarming/w/ir/k/src/third_party/llvm/compiler-rt/lib/asan/asan_interceptors.cc:209:3\n #1 0x5582ff6ebecf in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) base/threading/platform_thread_posix.cc:120:13\n #2 0x5582ff5c14b9 in base::internal::SchedulerWorker::Start(base::SchedulerWorkerObserver*) base/task/task_scheduler/scheduler_worker.cc:79:3\n #3 0x5582ff5be171 in operator() base/task/task_scheduler/scheduler_worker_pool_impl.cc:187:15\n #4 0x5582ff5be171 in ForEachWorker<(lambda at ../../base/task/task_scheduler/scheduler_worker_pool_impl.cc:186:37)> base/task/task_scheduler/scheduler_worker_pool_impl.cc:152\n #5 0x5582ff5be171 in base::internal::SchedulerWorkerPoolImpl::ScopedWorkersExecutor::FlushImpl() base/task/task_scheduler/scheduler_worker_pool_impl.cc:186\n #6 0x5582ff5b5c47 in base::internal::SchedulerWorkerPoolImpl::ScopedWorkersExecutor::~ScopedWorkersExecutor() base/task/task_scheduler/scheduler_worker_pool_impl.cc:105:30\n #7 0x5582ff5b5a57 in base::internal::SchedulerWorkerPoolImpl::Start(base::SchedulerWorkerPoolParams const&, int, scoped_refptr, base::SchedulerWorkerObserver*, base::internal::SchedulerWorkerPoolImpl::WorkerEnvironment, base::Optional) base/task/task_scheduler/scheduler_worker_pool_impl.cc:435:1\n #8 0x5582ff59ec04 in base::internal::TaskSchedulerImpl::Start(base::TaskScheduler::InitParams const&, base::SchedulerWorkerObserver*) base/task/task_scheduler/task_scheduler_impl.cc:142:21\n #9 0x5582f7f9791b in content::StartBrowserTaskScheduler() content/browser/startup_helper.cc:95:39\n #10 0x5582fe2d95d1 in content::ContentMainRunnerImpl::RunServiceManager(content::MainFunctionParams&, bool) content/app/content_main_runner_impl.cc:924:7\n #11 0x5582fe2d8edb in content::ContentMainRunnerImpl::Run(bool) content/app/content_main_runner_impl.cc:878:12\n #12 0x5582fe4401c6 in service_manager::Main(service_manager::MainParams const&) services/service_manager/embedder/main.cc:415:29\n #13 0x5582fe2d2d3c in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:10\n #14 0x5582f4635c2e in ChromeMain chrome/app/chrome_main.cc:103:12\n #15 0x7f954dbb92b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)\n\nSUMMARY: AddressSanitizer: heap-use-after-free base/memory/ref_counted.cc:43:3 in base::subtle::RefCountedBase::AddRefImpl() const\nShadow bytes around the buggy address:\n 0x0c2880018a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c2880018a90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c2880018aa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c2880018ab0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa\n 0x0c2880018ac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n=>0x0c2880018ad0: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c2880018ae0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c2880018af0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa\n 0x0c2880018b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c2880018b10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x0c2880018b20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==9152==ABORTING\n\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/cfi_bad_cast.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@cfi_bad_cast.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/cfi_bad_cast.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@cfi_bad_cast.txt.snap index e616f2d420..d9e8842674 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/cfi_bad_cast.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@cfi_bad_cast.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/cfi_bad_cast.txt +--- { "text": "Xlib: extension \"RANDR\" missing on display \":1\".\nXlib: extension \"RANDR\" missing on display \":1\".\nError: unrecognized flag --verify-heap\nTry --help for options\n[20699:20699:0207/193754:ERROR:object_proxy.cc(580)] Failed to call method: org.freedesktop.DBus.ObjectManager.GetManagedObjects: object_path= /: org.freedesktop.DBus.Error.ServiceUnknown: The name org.bluez was not provided by any .service files\n[20699:20699:0207/193754:ERROR:object_proxy.cc(580)] Failed to call method: org.freedesktop.DBus.ObjectManager.GetManagedObjects: object_path= /: org.freedesktop.DBus.Error.ServiceUnknown: The name org.bluez was not provided by any .service files\nError: unrecognized flag --verify-heap\nTry --help for options\nError: unrecognized flag --verify-heap\nTry --help for options\nError: unrecognized flag --verify-heap\nTry --help for options\n../../third_party/WebKit/Source/core/layout/LayoutObject.cpp:939:71: runtime error: control flow integrity check for type blink::LayoutObject failed during virtual call (vtable address 0x000000000000)\n0x000000000000: note: invalid vtable\n\n #0 0x7f83c1f7acba in blink::LayoutObject::containingBlock() const third_party/WebKit/Source/core/layout/LayoutObject.cpp:939:71\n #1 0x7f83c1f3a882 in blink::LayoutBox::topLeftLocation() const third_party/WebKit/Source/core/layout/LayoutBox.cpp:4396:35\n #2 0x7f83c1e60bcc in blink::PaintLayer::updateLayerPosition() third_party/WebKit/Source/core/paint/PaintLayer.cpp:769:27\n #3 0x7f83c1e609c2 in blink::PaintLayer::updateLayerPositionRecursive() third_party/WebKit/Source/core/paint/PaintLayer.cpp:305:5\n #4 0x7f83c1e60a77 in blink::PaintLayer::updateLayerPositionRecursive() third_party/WebKit/Source/core/paint/PaintLayer.cpp:323:9\n #5 0x7f83c1e60a77 in blink::PaintLayer::updateLayerPositionRecursive() third_party/WebKit/Source/core/paint/PaintLayer.cpp:323:9\n #6 0x7f83c1e608ce in blink::PaintLayer::updateLayerPositionsAfterLayout() third_party/WebKit/Source/core/paint/PaintLayer.cpp:293:5\n #7 0x7f83c1da5bc6 in blink::FrameView::layout() third_party/WebKit/Source/core/frame/FrameView.cpp:1050:5\n #8 0x7f83c1baf8f6 in blink::Document::updateLayout() third_party/WebKit/Source/core/dom/Document.cpp:1932:9\n #9 0x7f83c1bb6d01 in blink::Document::updateLayoutIgnorePendingStylesheets(blink::Document::RunPostLayoutTasks) third_party/WebKit/Source/core/dom/Document.cpp:2019:5\n #10 0x7f83c1d3c79b in blink::FrameSelection::absoluteCaretBounds() third_party/WebKit/Source/core/editing/FrameSelection.cpp:684:5\n #11 0x7f83c18d904a in blink::WebViewImpl::selectionBounds(blink::WebRect&, blink::WebRect&) const third_party/WebKit/Source/web/WebViewImpl.cpp:2598:26\n #12 0x7f83c2baa2c8 in content::RenderWidget::GetSelectionBounds(gfx::Rect*, gfx::Rect*) content/renderer/render_widget.cc:1949:3\n #13 0x7f83c2ba810e in content::RenderWidget::UpdateSelectionBounds() content/renderer/render_widget.cc:1978:5\n #14 0x7f83c2ba7faa in content::RenderWidget::WillBeginCompositorFrame() content/renderer/render_widget.cc:1231:3\n #15 0x7f83c1314c4b in cc::ProxyMain::BeginMainFrame(scoped_ptr >) cc/trees/proxy_main.cc:190:3\n #16 0x7f83c4395639 in base::internal::RunnableAdapter >)>::Run(cc::ProxyMain*, scoped_ptr >) base/bind_internal.h:179:12\n #17 0x7f83c43955b0 in base::internal::InvokeHelper >)>, base::internal::TypeList const&, scoped_ptr > > >::MakeItSo(base::internal::RunnableAdapter >)>, base::WeakPtr const&, scoped_ptr >) base/bind_internal.h:308:5\n #18 0x7f83c4395489 in base::internal::Invoker, base::internal::BindState >)>, void (cc::ProxyMain*, scoped_ptr >), base::WeakPtr, base::internal::PassedWrapper > > >, base::internal::TypeList >, base::internal::UnwrapTraits > > > >, base::internal::InvokeHelper >)>, base::internal::TypeList const&, scoped_ptr > > >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:348:12\n #19 0x7f83c0bc3131 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #20 0x7f83c2b6a88c in scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(scheduler::internal::WorkQueue*, scheduler::internal::TaskQueueImpl::Task*) components/scheduler/base/task_queue_manager.cc:286:3\n #21 0x7f83c2b69de4 in scheduler::TaskQueueManager::DoWork(base::TimeTicks, bool) components/scheduler/base/task_queue_manager.cc:198:13\n #22 0x7f83c3e00ecc in base::internal::InvokeHelper, base::internal::TypeList const&, safe_browsing::IncidentReportingService::UploadContext* const&, bool const&> >::MakeItSo(base::internal::RunnableAdapter, base::WeakPtr const&, safe_browsing::IncidentReportingService::UploadContext* const&, bool const&) base/bind_internal.h:308:5\n #23 0x7f83c0bc3131 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:3\n #24 0x7f83c0b8ac62 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:486:3\n #25 0x7f83c0b8ab2b in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:495:5\n #26 0x7f83c0b8aae5 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:607:13\n #27 0x7f83c0b8c3a3 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:33:21\n #28 0x7f83c0b8bda7 in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:450:3\n #29 0x7f83c0b9cf22 in base::RunLoop::Run() base/run_loop.cc:56:3\n #30 0x7f83c0b8b73c in base::MessageLoop::Run() base/message_loop/message_loop.cc:293:3\n #31 0x7f83c2bb0106 in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:226:7\n #32 0x7f83c0b4ff3e in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:294:14\n #33 0x7f83c4022a94 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:742:12\n #34 0x7f83c0b4fa9e in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #35 0x7f83c088ebad in ChromeMain chrome/app/chrome_main.cc:67:12\n #36 0x7f83b8f72ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\n #37 0x7f83c0874e10 in _start\n\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../third_party/WebKit/Source/core/layout/LayoutObject.cpp:939:71 in\nReceived signal 11 SEGV_MAPERR 0000000000b0\n#0 0x7f83c0b74253 base::debug::StackTrace::StackTrace()\n#1 0x7f83c0b74475 base::debug::(anonymous namespace)::StackDumpSignalHandler()\n#2 0x7f83ba358340 \n#3 0x7f83c1f7acbe blink::LayoutObject::containingBlock()\n#4 0x7f83c1f3a883 blink::LayoutBox::topLeftLocation()\n#5 0x7f83c1e60bcd Error: unrecognized flag --verify-heap\nTry --help for options\nblink::PaintLayer::updateLayerPosition()\n \n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/check_failure_google.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_google.txt.snap similarity index 96% rename from src/agent/libclusterfuzz/data/parsed-traces/check_failure_google.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_google.txt.snap index ed011a2718..7f748b417a 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/check_failure_google.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_google.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/check_failure_google.txt +--- { "text": "F0813 00:29:27.775753 384244 file.cc:130] Check failed: std::is_sorted(foo.begin(), foo.end())\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==384244==ERROR: AddressSanitizer: ABRT on unknown address 0x05390005dcf4 (pc 0x7f91eacc0602 bp 0x7ffeddeee0c0 sp 0x7ffeddeedf98 T0)\nSCARINESS: 10 (signal)\n #0 0x7f91eacc0601 in raise (/usr/grte/v4/lib64/libc.so.6+0xfffff)\n #1 0x7f91eacc231f in abort (/usr/grte/v4/lib64/libc.so.6+0xfffff)\n #6 0x560e73b80fe2 in Frame(int) file/path.cc:130:3\n #8 0x560e73b7d819 in LLVMFuzzerTestOneInput file/path.cc:10:1\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/usr/grte/v4/lib64/libc.so.6+0xfffff) in raise\n==384244==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/check_failure_vs_no_closing.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_vs_no_closing.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/check_failure_vs_no_closing.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_vs_no_closing.txt.snap index 8c14b808ca..68b99f3946 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/check_failure_vs_no_closing.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_vs_no_closing.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/check_failure_vs_no_closing.txt +--- { "text": "F0825 20:46:02.589571 1115822 file.cc:16] Check failed: record1 == record\u00062 ( vs. \u0001============================================================================================================================================================/===================N===================\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013\u0013&,ddddd(d[,eeee\u00061\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0002\u0006F\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0002\u0006\u0006\u0006zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\u0006\u0006\u0006\u0006\u0002\u0006F\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\n\u0005\n\u0005\u0006\u0006\u0003\u0006\u0006\u0006\u0006\u0006\u00060\u0006\u0006\u0006\u0002\u0006\u0006\u0006\u0006\u0006\u0006\u0002\u0006F\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u00061\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0014\u0002\u0006F\u0006\u0006ffffff\u0002\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\n\u0005\u000f\n)\u0006170141183460469231731687303715884105728\u0006\u0006\u0006\u0006\u0006\u0006\u0002\u0006\u0006\u0006\u0006\u0002\u0006F\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u00061\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0002\u0006F\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\n&\u0006\u0006\u0006\u0006\u0006\u00061\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0002\u0006F\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u00061\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD\u0002\u0006F\u0006\u0006\u00061\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0002\u0006F\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0002\u0006\u0006\u0006zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\u0006\u0006\u0006\u0006\u0002\u0006F\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\n\u0005\n\u0005\u0006\u0006\u0003\u0006\u0006\u0006\u0006\u0006\u00060\u0006\u0006\u0006\u0002\u0006\u0006\u0006\u0006\u0006\u0006\u0002\u0006F\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u00061\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0006\u0014\u0002\u0006F\u0006\u0006\u0005)\n#0 0x00000300a451 \n#1 0x000009d463ee \n#2 0x000009da88e3 \n#3 0x00001097fee9 \n#4 0x000010986d19 \n#5 0x000010aecd16 \n#6 0x000010aea349 \n#7 0x000010aea88b \n#8 0x000010a28ca2 \n#9 0x000010a29a25 \n#10 0x000010a2bf82 \n#11 0x000010a30475 \n#12 0x000010a30822 \n#13 0x000010944e43 \n#14 0x0000108e95bc \n#15 0x00000ef6932c \n#16 0x0000058c2b92 \n#17 0x0000058bfd84 \n#18 0x0000058bd3bc \n#19 0x7ea271a842bd \n\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x053900000001 (pc 0x7fe9a5149428 bp 0x7ffd8382f950 sp 0x7ffd8382f818 T0)\nSCARINESS: 10 (signal)\n==1==WARNING: invalid path to external symbolizer!\n==1==WARNING: Failed to use and restart external symbolizer!\n #0 0x7fe9a5149427 in gsignal /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54\n #1 0x9da929d in logging::LogMessage::~LogMessage() ../../base/logging.cc:855:7\n #2 0x1097fee8 in blink::TextIteratorAlgorithm >::TextIteratorAlgorithm(blink::PositionTemplate > const&, blink::PositionTemplate > const&, blink::TextIteratorBehavior const&) ../../third_party/blink/renderer/core/editing/iterators/text_iterator.cc:207:3\n #3 0x10986d18 in blink::TextIteratorAlgorithm >::RangeLength(blink::PositionTemplate > const&, blink::PositionTemplate > const&, blink::TextIteratorBehavior const&) ../../third_party/blink/renderer/core/editing/iterators/text_iterator.cc:908:40\n #4 0x10aecd15 in blink::TextOffsetMapping::ComputeTextOffset(blink::PositionTemplate > const&) const ../../third_party/blink/renderer/core/editing/text_offset_mapping.cc:104:10\n #5 0x10aea348 in NextWordPositionInternal ../../third_party/blink/renderer/core/editing/visible_units_word.cc:92:47\n #6 0x10aea348 in blink::NextWordPosition(blink::PositionTemplate > const&) ../../third_party/blink/renderer/core/editing/visible_units_word.cc:184\n #7 0x10aea88a in NextWordPosition ../../third_party/blink/renderer/core/editing/visible_units_word.cc:195:7\n #8 0x10aea88a in blink::NextWordPosition(blink::VisiblePositionTemplate > const&) ../../third_party/blink/renderer/core/editing/visible_units_word.cc:203\n #9 0x10a28ca1 in blink::SelectionModifier::NextWordPositionForPlatform(blink::VisiblePositionTemplate > const&) ../../third_party/blink/renderer/core/editing/selection_modifier.cc:234:7\n #10 0x10a29a24 in blink::SelectionModifier::ModifyExtendingForwardInternal(blink::TextGranularity) ../../third_party/blink/renderer/core/editing/selection_modifier.cc:315:14\n #11 0x10a2bf81 in blink::SelectionModifier::ModifyExtendingForward(blink::TextGranularity) ../../third_party/blink/renderer/core/editing/selection_modifier.cc:346:31\n #12 0x10a30474 in blink::SelectionModifier::ComputeModifyPosition(blink::SelectionModifyAlteration, blink::SelectionModifyDirection, blink::TextGranularity) ../../third_party/blink/renderer/core/editing/selection_modifier.cc:619:16\n #13 0x10a30821 in blink::SelectionModifier::Modify(blink::SelectionModifyAlteration, blink::SelectionModifyDirection, blink::TextGranularity) ../../third_party/blink/renderer/core/editing/selection_modifier.cc:648:7\n #14 0x10944e42 in blink::FrameSelection::Modify(blink::SelectionModifyAlteration, blink::SelectionModifyDirection, blink::TextGranularity, blink::SetSelectionBy) ../../third_party/blink/renderer/core/editing/frame_selection.cc:350:26\n #15 0x108e95bb in blink::DOMSelection::modify(WTF::String const&, WTF::String const&, WTF::String const&) ../../third_party/blink/renderer/core/editing/dom_selection.cc:457:27\n #16 0xef6932b in modifyMethod gen/third_party/blink/renderer/bindings/core/v8/v8_selection.cc:466:9\n #17 0xef6932b in blink::V8Selection::modifyMethodCallback(v8::FunctionCallbackInfo const&) gen/third_party/blink/renderer/bindings/core/v8/v8_selection.cc:666\n #18 0x58c2b91 in v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo*) ../../v8/src/api-arguments-inl.h:93:3\n #19 0x58bfd83 in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::BuiltinArguments) ../../v8/src/builtins/builtins-api.cc:107:36\n #20 0x58bd3bb in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) ../../v8/src/builtins/builtins-api.cc:137:5\n #18 0x7ea271a842bc ()\n #19 0x7ea271a931e8 ()\n #20 0x7ea271a8bfc2 ()\n #21 0x7ea271a907d4 ()\n #22 0x7ea271a86a40 ()\n #21 0x62919c4 in Call ../../v8/src/simulator.h:113:12\n #22 0x62919c4 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle, v8::internal::Execution::MessageHandling, v8::internal::Execution::Target) ../../v8/src/execution.cc:155\n #23 0x6290d52 in CallInternal ../../v8/src/execution.cc:191:10\n #24 0x6290d52 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) ../../v8/src/execution.cc:202\n #25 0x57543ad in v8::Function::Call(v8::Local, v8::Local, int, v8::Local*) ../../v8/src/api.cc:5119:7\n #26 0xea7573e in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) ../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:658:17\n #27 0xea89aa1 in blink::V8EventListener::CallListenerFunction(blink::ScriptState*, v8::Local, blink::Event*) ../../third_party/blink/renderer/bindings/core/v8/v8_event_listener.cc:115:8\n #28 0xea8b42f in blink::V8AbstractEventListener::InvokeEventHandler(blink::ScriptState*, blink::Event*, v8::Local) ../../third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:155:20\n #29 0xea8acab in blink::V8AbstractEventListener::HandleEvent(blink::ScriptState*, blink::Event*) ../../third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:104:3\n #30 0xea8a81b in blink::V8AbstractEventListener::handleEvent(blink::ExecutionContext*, blink::Event*) ../../third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:92:3\n #31 0x1064897d in blink::EventTarget::FireEventListeners(blink::Event*, blink::EventTargetData*, blink::HeapVector&) ../../third_party/blink/renderer/core/dom/events/event_target.cc:809:15\n #32 0x1064643a in blink::EventTarget::FireEventListeners(blink::Event*) ../../third_party/blink/renderer/core/dom/events/event_target.cc:661:29\n #33 0x106d5cb7 in blink::Node::HandleLocalEvents(blink::Event&) ../../third_party/blink/renderer/core/dom/node.cc:2242:3\n #34 0x1061d050 in blink::EventDispatcher::DispatchEventAtCapturing() ../../third_party/blink/renderer/core/dom/events/event_dispatcher.cc:216:19\n #35 0x1061bc97 in blink::EventDispatcher::Dispatch() ../../third_party/blink/renderer/core/dom/events/event_dispatcher.cc:177:9\n #36 0x10619a0f in blink::EventDispatcher::DispatchEvent(blink::Node&, blink::Event*) ../../third_party/blink/renderer/core/dom/events/event_dispatcher.cc:57:17\n #37 0x1065270d in DispatchEvent ../../third_party/blink/renderer/core/dom/events/scoped_event_queue.cc:76:3\n #38 0x1065270d in DispatchAllEvents ../../third_party/blink/renderer/core/dom/events/scoped_event_queue.cc:70\n #39 0x1065270d in blink::ScopedEventQueue::DecrementScopingLevel() ../../third_party/blink/renderer/core/dom/events/scoped_event_queue.cc:94\n #40 0x108eddb3 in blink::DOMSelection::deleteFromDocument() ../../third_party/blink/renderer/core/editing/dom_selection.cc:678:12\n #41 0xef67c82 in deleteFromDocumentMethod gen/third_party/blink/renderer/bindings/core/v8/v8_selection.cc:416:9\n #42 0xef67c82 in blink::V8Selection::deleteFromDocumentMethodCallback(v8::FunctionCallbackInfo const&) gen/third_party/blink/renderer/bindings/core/v8/v8_selection.cc:652\n #43 0x58c2b91 in v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo*) ../../v8/src/api-arguments-inl.h:93:3\n #44 0x58bfd83 in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::BuiltinArguments) ../../v8/src/builtins/builtins-api.cc:107:36\n #45 0x58bd3bb in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) ../../v8/src/builtins/builtins-api.cc:137:5\n #43 0x7ea271a842bc ()\n #44 0x7ea271a931e8 ()\n #45 0x7ea271a907d4 ()\n #46 0x7ea271a86a40 ()\n #46 0x62919c4 in Call ../../v8/src/simulator.h:113:12\n #47 0x62919c4 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle, v8::internal::Execution::MessageHandling, v8::internal::Execution::Target) ../../v8/src/execution.cc:155\n #48 0x6290d52 in CallInternal ../../v8/src/execution.cc:191:10\n #49 0x6290d52 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) ../../v8/src/execution.cc:202\n #50 0x57543ad in v8::Function::Call(v8::Local, v8::Local, int, v8::Local*) ../../v8/src/api.cc:5119:7\n #51 0xea7573e in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) ../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:658:17\n #52 0x10d8bf2b in blink::ScheduledAction::Execute(blink::LocalFrame*) ../../third_party/blink/renderer/bindings/core/v8/scheduled_action.cc:155:5\n #53 0x10d8b567 in blink::ScheduledAction::Execute(blink::ExecutionContext*) ../../third_party/blink/renderer/bindings/core/v8/scheduled_action.cc:107:5\n #54 0x10d884e7 in blink::DOMTimer::Fired() ../../third_party/blink/renderer/core/frame/dom_timer.cc:175:11\n #55 0xf8a7215 in blink::TimerBase::RunInternal() ../../third_party/blink/renderer/platform/timer.cc:161:3\n #56 0x9d4a6e9 in Run ../../base/callback.h:95:12\n #57 0x9d4a6e9 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) ../../base/debug/task_annotator.cc:101\n #58 0x75bd3aa in blink::scheduler::internal::ThreadControllerImpl::DoWork(blink::scheduler::internal::SequencedTaskSource::WorkType) ../../third_party/blink/renderer/platform/scheduler/base/thread_controller_impl.cc:162:21\n #59 0x9d4a6e9 in Run ../../base/callback.h:95:12\n #60 0x9d4a6e9 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) ../../base/debug/task_annotator.cc:101\n #61 0x9dbeb79 in base::MessageLoop::RunTask(base::PendingTask*) ../../base/message_loop/message_loop.cc:319:25\n #62 0x9dc003f in DeferOrRunPendingTask ../../base/message_loop/message_loop.cc:329:5\n #63 0x9dc003f in base::MessageLoop::DoWork() ../../base/message_loop/message_loop.cc:373\n #64 0x9dc9a9f in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ../../base/message_loop/message_pump_default.cc:37:31\n #65 0x9e4089b in base::RunLoop::Run() ../../base/run_loop.cc:130:14\n #66 0x155210e0 in content::RendererMain(content::MainFunctionParams const&) ../../content/renderer/renderer_main.cc:250:23\n #67 0x79fe10a in content::RunZygote(content::ContentMainDelegate*) ../../content/app/content_main_runner.cc:563:14\n #68 0x7a02665 in content::ContentMainRunnerImpl::Run() ../../content/app/content_main_runner.cc:923:12\n #69 0xe87cdf9 in service_manager::Main(service_manager::MainParams const&) ../../services/service_manager/embedder/main.cc:452:29\n #70 0x5408aa7 in content::ContentMain(content::ContentMainParams const&) ../../content/app/content_main.cc:19:10\n #71 0x3092b58 in main ../../content/shell/app/shell_main.cc:48:10\n #72 0x7fe9a513482f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x35427)\n==1==ABORTING\n==1==SanitizerCoverage: failed to open /mnt/scratch0/tmp/996/content_shell.1.sancov for writing (reason: 1)\nSanitizerCoverage: /mnt/scratch0/tmp/996/content_shell.1.sancov: 87845 PCs written\n==1==SanitizerCoverage: failed to open /mnt/scratch0/tmp/996/libblink_deprecated_test_plugin.so.1.sancov for writing (reason: 1)\nSanitizerCoverage: /mnt/scratch0/tmp/996/libblink_deprecated_test_plugin.so.1.sancov: 2 PCs written\n==1==SanitizerCoverage: failed to open /mnt/scratch0/tmp/996/libblink_test_plugin.so.1.sancov for writing (reason: 1)\nSanitizerCoverage: /mnt/scratch0/tmp/996/libblink_test_plugin.so.1.sancov: 2 PCs written\n==1==SanitizerCoverage: failed to open /mnt/scratch0/tmp/996/libc++.so.1.sancov for writing (reason: 1)\nSanitizerCoverage: /mnt/scratch0/tmp/996/libc++.so.1.sancov: 396 PCs written\n#CRASHED - renderer\nContent-Type: text/plain\n#CRASHED - renderer\n#EOF\n#EOF\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/check_failure_with_handle_sigill=1.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_with_handle_sigill=1.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/check_failure_with_handle_sigill=1.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_with_handle_sigill=1.txt.snap index f54c7be595..3ea1b87494 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/check_failure_with_handle_sigill=1.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_with_handle_sigill=1.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/check_failure_with_handle_sigill=1.txt +--- { "text": "$ ASAN_OPTIONS=redzone=32:symbolize=0:detect_stack_use_after_return=1:alloc_dealloc_mismatch=0:detect_leaks=1:print_scariness=1:check_malloc_usable_size=0:max_uar_stack_size_log=16:use_sigaltstack=1:strict_memcmp=0:detect_container_overflow=1:coverage=0:detect_odr_violation=0:allocator_may_return_null=1:handle_segv=1:fast_unwind_on_fatal=1:handle_sigill=1:symbolize=1 ~/chromium/src/out/Release/d8 --random-seed=-559099136 --invoke-weak-callbacks --omit-quit ./clusterfuzz-testcase-5095632168812544.js\n\n\n#\n# Fatal error in ../../v8/src/vector.h, line 24\n# Check failed: length == 0 || (length > 0 && data != __null).\n#\n\n==== C stack trace ===============================\n\n /home/user/chromium/src/out/Release/d8(backtrace+0x61) [0x7fe99fec1921]\n /home/user/chromium/src/out/Release/./libv8_libbase.so(+0x25213) [0x7fe99fe24213]\n /home/user/chromium/src/out/Release/./libv8_libbase.so(V8_Fatal+0x272) [0x7fe99fe1aa92]\n /home/user/chromium/src/out/Release/./libv8.so(+0x741549) [0x7fe99db4b549]\n /home/user/chromium/src/out/Release/./libv8.so(+0x7ded03) [0x7fe99dbe8d03]\n /home/user/chromium/src/out/Release/./libv8.so(+0x194cd84) [0x7fe99ed56d84]\n /home/user/chromium/src/out/Release/./libv8.so(+0x1946b08) [0x7fe99ed50b08]\n /home/user/chromium/src/out/Release/./libv8.so(+0x75a0e0) [0x7fe99db640e0]\n /home/user/chromium/src/out/Release/./libv8.so(+0x946efe) [0x7fe99dd50efe]\n /home/user/chromium/src/out/Release/./libv8.so(+0x945120) [0x7fe99dd4f120]\n /home/user/chromium/src/out/Release/./libv8.so(+0x9448a4) [0x7fe99dd4e8a4]\n [0x7fe973504204]\nASAN:DEADLYSIGNAL\n=================================================================\n==51822==ERROR: AddressSanitizer: ILL on unknown address 0x7fe99fe2140c (pc 0x7fe99fe2140c bp 0x7ffe1dcb3c50 sp 0x7ffe1dcb3c50 T0)\nSCARINESS: 10 (signal)\n #0 0x7fe99fe2140b in v8::base::OS::Abort() v8/src/base/platform/platform-posix.cc:253:5\n #1 0x7fe99fe1aacd in V8_Fatal v8/src/base/logging.cc:66:3\n #2 0x7fe99db4b548 in v8::internal::Vector::Vector(unsigned char const*, int) v8/src/vector.h:24:5\n #3 0x7fe99dbe8d02 in v8::internal::wasm::ModuleWireBytes::ModuleWireBytes(unsigned char const*, unsigned char const*) v8/src/wasm/wasm-module.h:219:9\n #4 0x7fe99ed56d83 in v8::(anonymous namespace)::GetFirstArgumentAsBytes(v8::FunctionCallbackInfo const&, v8::internal::wasm::ErrorThrower*) v8/src/wasm/wasm-js.cc:155:10\n #5 0x7fe99ed50b07 in v8::(anonymous namespace)::WebAssemblyValidate(v8::FunctionCallbackInfo const&) v8/src/wasm/wasm-js.cc:201:16\n #6 0x7fe99db640df in v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo const&)) v8/src/api-arguments.cc:25:3\n #7 0x7fe99dd50efd in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::BuiltinArguments) v8/src/builtins/builtins-api.cc:111:36\n #8 0x7fe99dd4f11f in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-api.cc:140:5\n #9 0x7fe99dd4e8a3 in v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) v8/src/builtins/builtins-api.cc:128:1\n #10 0x7fe973504203 ()\n #11 0x7fe9736847df ()\n #12 0x7fe9735d4538 ()\n #13 0x7fe9735295ac ()\n #14 0x7fe99e57824f in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle, v8::internal::Execution::MessageHandling) v8/src/execution.cc:144:13\n #15 0x7fe99e57779f in v8::internal::(anonymous namespace)::CallInternal(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Execution::MessageHandling) v8/src/execution.cc:180:10\n #16 0x7fe99e577574 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:190:10\n #17 0x7fe99db87c97 in v8::Script::Run(v8::Local) v8/src/api.cc:2040:7\n #18 0x7fe99ff4c607 in v8::Shell::ExecuteString(v8::Isolate*, v8::Local, v8::Local, bool, bool) v8/src/d8.cc:522:28\n #19 0x7fe99ff611f3 in v8::SourceGroup::Execute(v8::Isolate*) v8/src/d8.cc:2106:10\n #20 0x7fe99ff66e3a in v8::Shell::RunMain(v8::Isolate*, int, char**, bool) v8/src/d8.cc:2526:34\n #21 0x7fe99ff68cbe in v8::Shell::Main(int, char**) v8/src/d8.cc:2978:16\n #22 0x7fe99b3d4f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ILL v8/src/base/platform/platform-posix.cc:253:5 in v8::base::OS::Abort()\n==51822==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/check_failure_with_msan_abrt.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_with_msan_abrt.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/check_failure_with_msan_abrt.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_with_msan_abrt.txt.snap index 653aeefc0b..50826ba7d3 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/check_failure_with_msan_abrt.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_with_msan_abrt.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/check_failure_with_msan_abrt.txt +--- { "text": "[0322/192646.353108:FATAL:string_piece.h(223)] Check failed: i < length_.\n#0 0x00000029f221 \n#1 0x0000003847a7 \n#2 0x0000003813e9 \n#3 0x0000003e770d \n#4 0x00000036c7b1 \n#5 0x00000036a8fe \n#6 0x000000368bcf \n#7 0x000000365c2e \n#8 0x000000364faf \n#9 0x000000363820 \n#10 0x0000002d5b21 \n#11 0x00000030b44a \n#12 0x0000002d6e81 \n #13 0x0000002e2475 \n#14 0x00000032b361 \n#15 0x7f60199b2830 \n#16 0x00000026302a \nMemorySanitizer:DEADLYSIGNAL\n==18344==ERROR: MemorySanitizer: ABRT on unknown address 0x0539000047a8 (pc 0x7f60199c7428 bp 0x7fff52f63cf0 sp 0x7fff52f63bb8 T18344)\n #0 0x7f60199c7427 in gsignal /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54\n #1 0x7f60199c9029 in abort /build/glibc-Cl5G7W/glibc-2.23/stdlib/abort.c:89\n #2 0x386f63 in base::debug::BreakDebugger() base/debug/debugger_posix.cc:258:3\n #3 0x3818c6 in logging::LogMessage::~LogMessage() base/logging.cc:855:7\n #4 0x3e770c in base::BasicStringPiece, std::__1::allocator > >::operator[](unsigned long) const base/strings/string_piece.h:223:5\n #5 0x36c7b0 in base::internal::JSONParser::ConsumeStringRaw(base::internal::JSONParser::StringBuilder*) base/json/json_parser.cc:515:15\n #6 0x36a8fd in base::internal::JSONParser::ConsumeString() base/json/json_parser.cc:453:8\n #7 0x368bce in base::internal::JSONParser::ParseToken(base::internal::JSONParser::Token) base/json/json_parser.cc:320:14\n #8 0x365c2d in base::internal::JSONParser::ParseNextToken() base/json/json_parser.cc:310:10\n #9 0x364fae in base::internal::JSONParser::Parse(base::BasicStringPiece, std::__1::allocator > >) base/json/json_parser.cc:100:24\n #10 0x36381f in base::JSONReader::ReadAndReturnError(base::BasicStringPiece, std::__1::allocator > >, int, int*, std::__1::basic_string, std::__1::allocator >*, int*, int*) base/json/json_reader.cc:68:33\n #11 0x2d5b20 in LLVMFuzzerTestOneInput base/json/json_reader_fuzzer.cc:24:3\n #12 0x30b449 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:515:13\n #13 0x2d6e80 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:280:6\n #14 0x2e2474 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:703:9\n #15 0x32b360 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10\n #16 0x7f60199b282f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291\n #17 0x263029 in _start\nMemorySanitizer can not provide additional info.\nSUMMARY: MemorySanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x35427)\n==18344==ABORTING\n", "sanitizer": "MemorySanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/check_failure_with_string_vs_string.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_with_string_vs_string.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/check_failure_with_string_vs_string.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_with_string_vs_string.txt.snap index e3ec5946f1..16abea367e 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/check_failure_with_string_vs_string.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@check_failure_with_string_vs_string.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/check_failure_with_string_vs_string.txt +--- { "text": "[1:1:0417/224500.881615:FATAL:text_iterator.cc(207)] Check failed: start <= end (DIV (editable)@beforeChildren vs. DIV class=\"CLASS0 CLASS11\"@offsetInAnchor[0])\n#0 0x00000300a451 \n#1 0x000009d463ee \n#2 0x000009da88e3 \n#3 0x00001097fee9 \n#4 0x000010986d19 \n#5 0x000010aecd16 \n#6 0x000010aea349 \n#7 0x000010aea88b \n#8 0x000010a28ca2 \n#9 0x000010a29a25 \n#10 0x000010a2bf82 \n#11 0x000010a30475 \n#12 0x000010a30822 \n#13 0x000010944e43 \n#14 0x0000108e95bc \n#15 0x00000ef6932c \n#16 0x0000058c2b92 \n#17 0x0000058bfd84 \n#18 0x0000058bd3bc \n#19 0x7ea271a842bd \n\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x053900000001 (pc 0x7fe9a5149428 bp 0x7ffd8382f950 sp 0x7ffd8382f818 T0)\nSCARINESS: 10 (signal)\n==1==WARNING: invalid path to external symbolizer!\n==1==WARNING: Failed to use and restart external symbolizer!\n #0 0x7fe9a5149427 in gsignal /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54\n #1 0x9da929d in logging::LogMessage::~LogMessage() ../../base/logging.cc:855:7\n #2 0x1097fee8 in blink::TextIteratorAlgorithm >::TextIteratorAlgorithm(blink::PositionTemplate > const&, blink::PositionTemplate > const&, blink::TextIteratorBehavior const&) ../../third_party/blink/renderer/core/editing/iterators/text_iterator.cc:207:3\n #3 0x10986d18 in blink::TextIteratorAlgorithm >::RangeLength(blink::PositionTemplate > const&, blink::PositionTemplate > const&, blink::TextIteratorBehavior const&) ../../third_party/blink/renderer/core/editing/iterators/text_iterator.cc:908:40\n #4 0x10aecd15 in blink::TextOffsetMapping::ComputeTextOffset(blink::PositionTemplate > const&) const ../../third_party/blink/renderer/core/editing/text_offset_mapping.cc:104:10\n #5 0x10aea348 in NextWordPositionInternal ../../third_party/blink/renderer/core/editing/visible_units_word.cc:92:47\n #6 0x10aea348 in blink::NextWordPosition(blink::PositionTemplate > const&) ../../third_party/blink/renderer/core/editing/visible_units_word.cc:184\n #7 0x10aea88a in NextWordPosition ../../third_party/blink/renderer/core/editing/visible_units_word.cc:195:7\n #8 0x10aea88a in blink::NextWordPosition(blink::VisiblePositionTemplate > const&) ../../third_party/blink/renderer/core/editing/visible_units_word.cc:203\n #9 0x10a28ca1 in blink::SelectionModifier::NextWordPositionForPlatform(blink::VisiblePositionTemplate > const&) ../../third_party/blink/renderer/core/editing/selection_modifier.cc:234:7\n #10 0x10a29a24 in blink::SelectionModifier::ModifyExtendingForwardInternal(blink::TextGranularity) ../../third_party/blink/renderer/core/editing/selection_modifier.cc:315:14\n #11 0x10a2bf81 in blink::SelectionModifier::ModifyExtendingForward(blink::TextGranularity) ../../third_party/blink/renderer/core/editing/selection_modifier.cc:346:31\n #12 0x10a30474 in blink::SelectionModifier::ComputeModifyPosition(blink::SelectionModifyAlteration, blink::SelectionModifyDirection, blink::TextGranularity) ../../third_party/blink/renderer/core/editing/selection_modifier.cc:619:16\n #13 0x10a30821 in blink::SelectionModifier::Modify(blink::SelectionModifyAlteration, blink::SelectionModifyDirection, blink::TextGranularity) ../../third_party/blink/renderer/core/editing/selection_modifier.cc:648:7\n #14 0x10944e42 in blink::FrameSelection::Modify(blink::SelectionModifyAlteration, blink::SelectionModifyDirection, blink::TextGranularity, blink::SetSelectionBy) ../../third_party/blink/renderer/core/editing/frame_selection.cc:350:26\n #15 0x108e95bb in blink::DOMSelection::modify(WTF::String const&, WTF::String const&, WTF::String const&) ../../third_party/blink/renderer/core/editing/dom_selection.cc:457:27\n #16 0xef6932b in modifyMethod gen/third_party/blink/renderer/bindings/core/v8/v8_selection.cc:466:9\n #17 0xef6932b in blink::V8Selection::modifyMethodCallback(v8::FunctionCallbackInfo const&) gen/third_party/blink/renderer/bindings/core/v8/v8_selection.cc:666\n #18 0x58c2b91 in v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo*) ../../v8/src/api-arguments-inl.h:93:3\n #19 0x58bfd83 in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::BuiltinArguments) ../../v8/src/builtins/builtins-api.cc:107:36\n #20 0x58bd3bb in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) ../../v8/src/builtins/builtins-api.cc:137:5\n #18 0x7ea271a842bc ()\n #19 0x7ea271a931e8 ()\n #20 0x7ea271a8bfc2 ()\n #21 0x7ea271a907d4 ()\n #22 0x7ea271a86a40 ()\n #21 0x62919c4 in Call ../../v8/src/simulator.h:113:12\n #22 0x62919c4 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle, v8::internal::Execution::MessageHandling, v8::internal::Execution::Target) ../../v8/src/execution.cc:155\n #23 0x6290d52 in CallInternal ../../v8/src/execution.cc:191:10\n #24 0x6290d52 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) ../../v8/src/execution.cc:202\n #25 0x57543ad in v8::Function::Call(v8::Local, v8::Local, int, v8::Local*) ../../v8/src/api.cc:5119:7\n #26 0xea7573e in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) ../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:658:17\n #27 0xea89aa1 in blink::V8EventListener::CallListenerFunction(blink::ScriptState*, v8::Local, blink::Event*) ../../third_party/blink/renderer/bindings/core/v8/v8_event_listener.cc:115:8\n #28 0xea8b42f in blink::V8AbstractEventListener::InvokeEventHandler(blink::ScriptState*, blink::Event*, v8::Local) ../../third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:155:20\n #29 0xea8acab in blink::V8AbstractEventListener::HandleEvent(blink::ScriptState*, blink::Event*) ../../third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:104:3\n #30 0xea8a81b in blink::V8AbstractEventListener::handleEvent(blink::ExecutionContext*, blink::Event*) ../../third_party/blink/renderer/bindings/core/v8/v8_abstract_event_listener.cc:92:3\n #31 0x1064897d in blink::EventTarget::FireEventListeners(blink::Event*, blink::EventTargetData*, blink::HeapVector&) ../../third_party/blink/renderer/core/dom/events/event_target.cc:809:15\n #32 0x1064643a in blink::EventTarget::FireEventListeners(blink::Event*) ../../third_party/blink/renderer/core/dom/events/event_target.cc:661:29\n #33 0x106d5cb7 in blink::Node::HandleLocalEvents(blink::Event&) ../../third_party/blink/renderer/core/dom/node.cc:2242:3\n #34 0x1061d050 in blink::EventDispatcher::DispatchEventAtCapturing() ../../third_party/blink/renderer/core/dom/events/event_dispatcher.cc:216:19\n #35 0x1061bc97 in blink::EventDispatcher::Dispatch() ../../third_party/blink/renderer/core/dom/events/event_dispatcher.cc:177:9\n #36 0x10619a0f in blink::EventDispatcher::DispatchEvent(blink::Node&, blink::Event*) ../../third_party/blink/renderer/core/dom/events/event_dispatcher.cc:57:17\n #37 0x1065270d in DispatchEvent ../../third_party/blink/renderer/core/dom/events/scoped_event_queue.cc:76:3\n #38 0x1065270d in DispatchAllEvents ../../third_party/blink/renderer/core/dom/events/scoped_event_queue.cc:70\n #39 0x1065270d in blink::ScopedEventQueue::DecrementScopingLevel() ../../third_party/blink/renderer/core/dom/events/scoped_event_queue.cc:94\n #40 0x108eddb3 in blink::DOMSelection::deleteFromDocument() ../../third_party/blink/renderer/core/editing/dom_selection.cc:678:12\n #41 0xef67c82 in deleteFromDocumentMethod gen/third_party/blink/renderer/bindings/core/v8/v8_selection.cc:416:9\n #42 0xef67c82 in blink::V8Selection::deleteFromDocumentMethodCallback(v8::FunctionCallbackInfo const&) gen/third_party/blink/renderer/bindings/core/v8/v8_selection.cc:652\n #43 0x58c2b91 in v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo*) ../../v8/src/api-arguments-inl.h:93:3\n #44 0x58bfd83 in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::BuiltinArguments) ../../v8/src/builtins/builtins-api.cc:107:36\n #45 0x58bd3bb in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) ../../v8/src/builtins/builtins-api.cc:137:5\n #43 0x7ea271a842bc ()\n #44 0x7ea271a931e8 ()\n #45 0x7ea271a907d4 ()\n #46 0x7ea271a86a40 ()\n #46 0x62919c4 in Call ../../v8/src/simulator.h:113:12\n #47 0x62919c4 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle, v8::internal::Execution::MessageHandling, v8::internal::Execution::Target) ../../v8/src/execution.cc:155\n #48 0x6290d52 in CallInternal ../../v8/src/execution.cc:191:10\n #49 0x6290d52 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) ../../v8/src/execution.cc:202\n #50 0x57543ad in v8::Function::Call(v8::Local, v8::Local, int, v8::Local*) ../../v8/src/api.cc:5119:7\n #51 0xea7573e in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) ../../third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:658:17\n #52 0x10d8bf2b in blink::ScheduledAction::Execute(blink::LocalFrame*) ../../third_party/blink/renderer/bindings/core/v8/scheduled_action.cc:155:5\n #53 0x10d8b567 in blink::ScheduledAction::Execute(blink::ExecutionContext*) ../../third_party/blink/renderer/bindings/core/v8/scheduled_action.cc:107:5\n #54 0x10d884e7 in blink::DOMTimer::Fired() ../../third_party/blink/renderer/core/frame/dom_timer.cc:175:11\n #55 0xf8a7215 in blink::TimerBase::RunInternal() ../../third_party/blink/renderer/platform/timer.cc:161:3\n #56 0x9d4a6e9 in Run ../../base/callback.h:95:12\n #57 0x9d4a6e9 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) ../../base/debug/task_annotator.cc:101\n #58 0x75bd3aa in blink::scheduler::internal::ThreadControllerImpl::DoWork(blink::scheduler::internal::SequencedTaskSource::WorkType) ../../third_party/blink/renderer/platform/scheduler/base/thread_controller_impl.cc:162:21\n #59 0x9d4a6e9 in Run ../../base/callback.h:95:12\n #60 0x9d4a6e9 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) ../../base/debug/task_annotator.cc:101\n #61 0x9dbeb79 in base::MessageLoop::RunTask(base::PendingTask*) ../../base/message_loop/message_loop.cc:319:25\n #62 0x9dc003f in DeferOrRunPendingTask ../../base/message_loop/message_loop.cc:329:5\n #63 0x9dc003f in base::MessageLoop::DoWork() ../../base/message_loop/message_loop.cc:373\n #64 0x9dc9a9f in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ../../base/message_loop/message_pump_default.cc:37:31\n #65 0x9e4089b in base::RunLoop::Run() ../../base/run_loop.cc:130:14\n #66 0x155210e0 in content::RendererMain(content::MainFunctionParams const&) ../../content/renderer/renderer_main.cc:250:23\n #67 0x79fe10a in content::RunZygote(content::ContentMainDelegate*) ../../content/app/content_main_runner.cc:563:14\n #68 0x7a02665 in content::ContentMainRunnerImpl::Run() ../../content/app/content_main_runner.cc:923:12\n #69 0xe87cdf9 in service_manager::Main(service_manager::MainParams const&) ../../services/service_manager/embedder/main.cc:452:29\n #70 0x5408aa7 in content::ContentMain(content::ContentMainParams const&) ../../content/app/content_main.cc:19:10\n #71 0x3092b58 in main ../../content/shell/app/shell_main.cc:48:10\n #72 0x7fe9a513482f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x35427)\n==1==ABORTING\n==1==SanitizerCoverage: failed to open /mnt/scratch0/tmp/996/content_shell.1.sancov for writing (reason: 1)\nSanitizerCoverage: /mnt/scratch0/tmp/996/content_shell.1.sancov: 87845 PCs written\n==1==SanitizerCoverage: failed to open /mnt/scratch0/tmp/996/libblink_deprecated_test_plugin.so.1.sancov for writing (reason: 1)\nSanitizerCoverage: /mnt/scratch0/tmp/996/libblink_deprecated_test_plugin.so.1.sancov: 2 PCs written\n==1==SanitizerCoverage: failed to open /mnt/scratch0/tmp/996/libblink_test_plugin.so.1.sancov for writing (reason: 1)\nSanitizerCoverage: /mnt/scratch0/tmp/996/libblink_test_plugin.so.1.sancov: 2 PCs written\n==1==SanitizerCoverage: failed to open /mnt/scratch0/tmp/996/libc++.so.1.sancov for writing (reason: 1)\nSanitizerCoverage: /mnt/scratch0/tmp/996/libc++.so.1.sancov: 396 PCs written\n#CRASHED - renderer\nContent-Type: text/plain\n#CRASHED - renderer\n#EOF\n#EOF\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/cobalt_check.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@cobalt_check.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/cobalt_check.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@cobalt_check.txt.snap index 48030a318f..c85da130a9 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/cobalt_check.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@cobalt_check.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/cobalt_check.txt +--- { "text": "[0922/115903:FATAL:font_list.cc(299)] Check failed: space_width_ > 0 (0 vs. 0)\nbase::debug::StackTrace::StackTrace() [0x13d6753]\nlogging::LogMessage::~LogMessage() [0x13d282d]\ncobalt::dom::FontList::GenerateSpaceWidth() [0x1bfc00c]\ncobalt::dom::FontList::GetSpaceWidth() [0x1bfbcfe]\ncobalt::layout::TextBox::GetTrailingWhiteSpaceWidth() [0x42b0ad1]\ncobalt::layout::TextBox::UpdateContentSizeAndMargins() [0x42afac5]\ncobalt::layout::Box::UpdateSize() [0x41ef258]\ncobalt::layout::LineBox::BeginAddChildAndMaybeOverflow() [0x425b551]\ncobalt::layout::InlineContainerBox::UpdateContentSizeAndMargins() [0x4231989]\ncobalt::layout::Box::UpdateSize() [0x41ef258]\ncobalt::layout::LineBox::TryAddChildAndMaybeWrap() [0x4258bb8]\ncobalt::layout::InlineFormattingContext::TryAddChildAndMaybeWrap() [0x425151b]\ncobalt::layout::AnonymousBlockBox::UpdateRectOfInFlowChildBoxes() [0x423d0ba]\ncobalt::layout::BlockContainerBox::UpdateContentHeightAndMargins() [0x4248032]\ncobalt::layout::BlockContainerBox::UpdateContentSizeAndMargins() [0x424db69]\ncobalt::layout::Box::UpdateSize() [0x41ef258]\ncobalt::layout::BlockFormattingContext::UpdateRect() [0x425421c]\ncobalt::layout::BlockFormattingBlockContainerBox::UpdateRectOfInFlowChildBoxes() [0x4239ea5]\ncobalt::layout::BlockContainerBox::UpdateContentHeightAndMargins() [0x4248032]\ncobalt::layout::BlockContainerBox::UpdateContentSizeAndMargins() [0x424db69]\ncobalt::layout::Box::UpdateSize() [0x41ef258]\ncobalt::layout::BlockFormattingContext::UpdateRect() [0x425421c]\ncobalt::layout::BlockFormattingBlockContainerBox::UpdateRectOfInFlowChildBoxes() [0x4239ea5]\ncobalt::layout::BlockContainerBox::UpdateContentHeightAndMargins() [0x4248032]\ncobalt::layout::BlockContainerBox::UpdateContentSizeAndMargins() [0x424db69]\ncobalt::layout::Box::UpdateSize() [0x41ef258]\ncobalt::layout::BlockFormattingContext::UpdateRect() [0x425421c]\ncobalt::layout::BlockFormattingBlockContainerBox::UpdateRectOfInFlowChildBoxes() [0x4239ea5]\ncobalt::layout::BlockContainerBox::UpdateContentHeightAndMargins() [0x4248032]\ncobalt::layout::BlockContainerBox::UpdateContentSizeAndMargins() [0x424db69]\ncobalt::layout::Box::UpdateSize() [0x41ef258]\ncobalt::layout::UpdateComputedStylesAndLayoutBoxTree() [0x41dd320]\ncobalt::layout::LayoutManager::Impl::DoLayoutAndProduceRenderTree() [0x41d7793]\nbase::Timer::RunScheduledTask() [0x1492b58]\nbase::BaseTimerTaskInternal::Run() [0x1493027]\nMessageLoop::RunTask() [0x13e283b]\nMessageLoop::DoDelayedWork() [0x13e3ce6]\nbase::MessagePumpDefault::Run() [0x13ead23]\nMessageLoop::RunInternal() [0x13e189a]\nbase::RunLoop::Run() [0x1429dfa]\nMessageLoop::Run() [0x13dfd87]\nbase::Thread::ThreadMain() [0x1488773]\nbase::(anonymous namespace)::ThreadFunc() [0x148309e]\n(anonymous namespace)::ThreadFunc() [0x14e8d53]\nstart_thread [0x7fb2b2990184]\n [0x7fb2b1a8abed]\n [0x7fb2b1a8abed]\nASAN:DEADLYSIGNAL\n=================================================================\n==8173==ERROR: AddressSanitizer: ILL on unknown address 0x0000014e7ce9 (pc 0x0000014e7ce9 bp 0x7fb2a02f02e0 sp 0x7fb2a02f02e0 T17)\nSCARINESS: 10 (signal)\n #0 0x14e7ce8 in SbSystemBreakIntoDebugger /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/starboard/shared/posix/system_break_into_debugger.cc:23:3\n #1 0x13d7c2d in base::debug::BreakDebugger() /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/debug/debugger_starboard.cc:37:3\n #2 0x13d2f31 in logging::LogMessage::~LogMessage() /usr/include/c++/4.8/bits/basic_string.h:0:8\n #3 0x1bfc00b in cobalt::dom::FontList::GenerateSpaceWidth() /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/dom/font_list.cc:299:5\n #4 0x1bfbcfd in cobalt::dom::FontList::GetSpaceWidth() /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/dom/font_list.cc:170:3\n #5 0x42b0ad0 in cobalt::layout::TextBox::GetTrailingWhiteSpaceWidth() const /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/text_box.cc:685:39\n #6 0x42afac4 in cobalt::layout::TextBox::UpdateContentSizeAndMargins(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/text_box.cc:162:13\n #7 0x41ef257 in cobalt::layout::Box::UpdateSize(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/box.cc:118:3\n #8 0x425b550 in cobalt::layout::LineBox::UpdateSizePreservingTrailingWhiteSpace(cobalt::layout::Box*) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/line_box.cc:224:14\n #9 0x425b550 in cobalt::layout::LineBox::BeginAddChildAndMaybeOverflow(cobalt::layout::Box*) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/line_box.cc:141\n #10 0x4231988 in cobalt::layout::InlineContainerBox::UpdateContentSizeAndMargins(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/inline_container_box.cc:110:14\n #11 0x41ef257 in cobalt::layout::Box::UpdateSize(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/box.cc:118:3\n #12 0x4258bb7 in cobalt::layout::LineBox::UpdateSizePreservingTrailingWhiteSpace(cobalt::layout::Box*) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/line_box.cc:224:14\n #13 0x4258bb7 in cobalt::layout::LineBox::TryAddChildAndMaybeWrap(cobalt::layout::Box*) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/line_box.cc:70\n #14 0x425151a in cobalt::layout::InlineFormattingContext::TryAddChildAndMaybeWrap(cobalt::layout::Box*) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/inline_formatting_context.cc:55:43\n #15 0x423d0b9 in cobalt::layout::AnonymousBlockBox::UpdateRectOfInFlowChildBoxes(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/anonymous_block_box.cc:157:36\n #16 0x4248031 in cobalt::layout::BlockContainerBox::UpdateContentHeightAndMargins(cobalt::layout::SizeLayoutUnit const&, starboard::optional const&, starboard::optional const&, starboard::optional const&, starboard::optional const&, starboard::optional const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_container_box.cc:117:7\n #17 0x424db68 in cobalt::layout::BlockContainerBox::UpdateContentSizeAndMargins(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_container_box.cc:209:3\n #18 0x41ef257 in cobalt::layout::Box::UpdateSize(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/box.cc:118:3\n #19 0x425421b in cobalt::layout::BlockFormattingContext::UpdateRect(cobalt::layout::Box*) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_formatting_context.cc:34:14\n #20 0x4239ea4 in cobalt::layout::BlockFormattingBlockContainerBox::UpdateRectOfInFlowChildBoxes(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_formatting_block_container_box.cc:74:33\n #21 0x4248031 in cobalt::layout::BlockContainerBox::UpdateContentHeightAndMargins(cobalt::layout::SizeLayoutUnit const&, starboard::optional const&, starboard::optional const&, starboard::optional const&, starboard::optional const&, starboard::optional const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_container_box.cc:117:7\n #22 0x424db68 in cobalt::layout::BlockContainerBox::UpdateContentSizeAndMargins(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_container_box.cc:209:3\n #23 0x41ef257 in cobalt::layout::Box::UpdateSize(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/box.cc:118:3\n #24 0x425421b in cobalt::layout::BlockFormattingContext::UpdateRect(cobalt::layout::Box*) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_formatting_context.cc:34:14\n #25 0x4239ea4 in cobalt::layout::BlockFormattingBlockContainerBox::UpdateRectOfInFlowChildBoxes(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_formatting_block_container_box.cc:74:33\n #26 0x4248031 in cobalt::layout::BlockContainerBox::UpdateContentHeightAndMargins(cobalt::layout::SizeLayoutUnit const&, starboard::optional const&, starboard::optional const&, starboard::optional const&, starboard::optional const&, starboard::optional const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_container_box.cc:117:7\n #27 0x424db68 in cobalt::layout::BlockContainerBox::UpdateContentSizeAndMargins(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_container_box.cc:209:3\n #28 0x41ef257 in cobalt::layout::Box::UpdateSize(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/box.cc:118:3\n #29 0x425421b in cobalt::layout::BlockFormattingContext::UpdateRect(cobalt::layout::Box*) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_formatting_context.cc:34:14\n #30 0x4239ea4 in cobalt::layout::BlockFormattingBlockContainerBox::UpdateRectOfInFlowChildBoxes(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_formatting_block_container_box.cc:74:33\n #31 0x4248031 in cobalt::layout::BlockContainerBox::UpdateContentHeightAndMargins(cobalt::layout::SizeLayoutUnit const&, starboard::optional const&, starboard::optional const&, starboard::optional const&, starboard::optional const&, starboard::optional const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_container_box.cc:117:7\n #32 0x424db68 in cobalt::layout::BlockContainerBox::UpdateContentSizeAndMargins(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/block_container_box.cc:209:3\n #33 0x41ef257 in cobalt::layout::Box::UpdateSize(cobalt::layout::LayoutParams const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/box.cc:118:3\n #34 0x41dd31f in cobalt::layout::UpdateComputedStylesAndLayoutBoxTree(icu_56::Locale const&, scoped_refptr const&, int, cobalt::layout::UsedStyleProvider*, cobalt::layout::LayoutStatTracker*, icu_56::BreakIterator*, icu_56::BreakIterator*, scoped_refptr*) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/layout.cc:126:34\n #35 0x41d7792 in cobalt::layout::LayoutManager::Impl::DoLayoutAndProduceRenderTree() /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/cobalt/layout/layout_manager.cc:364:7\n #36 0x1492b57 in base::Callback::Run() const /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/callback.h:412:12\n #37 0x1492b57 in base::Timer::RunScheduledTask() /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/timer.cc:240\n #38 0x1493026 in base::BaseTimerTaskInternal::Run() /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/timer.cc:48:12\n #39 0x13e283a in base::Callback::Run() const /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/callback.h:412:12\n #40 0x13e283a in MessageLoop::RunTask(base::PendingTask const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/message_loop.cc:548\n #41 0x13e3ce5 in MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/message_loop.cc:560:5\n #42 0x13e3ce5 in MessageLoop::DoDelayedWork(base::TimeTicks*) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/message_loop.cc:782\n #43 0x13ead22 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/message_pump_default.cc:35:27\n #44 0x13e1899 in MessageLoop::RunInternal() /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/message_loop.cc:491:10\n #45 0x1429df9 in base::RunLoop::Run() /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/run_loop.cc:47:10\n #46 0x13dfd86 in MessageLoop::Run() /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/message_loop.cc:363:12\n #47 0x1488772 in base::Thread::ThreadMain() /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/threading/thread.cc:212:5\n #48 0x148309d in base::(anonymous namespace)::ThreadFunc(void*) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/base/threading/platform_thread_starboard.cc:44:13\n #49 0x14e8d52 in (anonymous namespace)::ThreadFunc(void*) /home/youtube-steel-buildbot/buildbot/cobalt_rc_12/workdir/src/starboard/shared/pthread/thread_create.cc:71:10\n #50 0x7fb2b2990183 in start_thread /build/eglibc-MjiXCM/eglibc-2.19/nptl/pthread_create.c:312\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ILL (/mnt/scratch0/clusterfuzz/bot/builds/cobalt-builds_linux-devel-asan_08e56780ffe0b265ae7807a86955f2ec0d67953a/symbolized/release/cobalt+0x14e7ce8)\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/fuchsia_asan.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@fuchsia_asan.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/fuchsia_asan.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@fuchsia_asan.txt.snap index 548a857dfe..f5363be586 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/fuchsia_asan.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@fuchsia_asan.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/fuchsia_asan.txt +--- { "text": "INFO: Seed: 4194731854\nINFO: Loaded 1 modules (8 inline 8-bit counters): 8 [0x71dc3915b090, 0x71dc3915b098), \nINFO: Loaded 1 PC tables (8 PCs): 8 [0x71dc3915b098,0x71dc3915b118), \nINFO: 0 files found in data/corpus/\nINFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes\ndso: id=2531e2d2f5d7322c base=0x000071dc390a7000 name=/pkg/bin/toy_fuzzer\ndso: id=b715d488354a413b base=0x00004c51954bd000 name=libc++.so.2\ndso: id=a889bd8ebd385a59 base=0x000041df65fbc000 name=libunwind.so.1\ndso: id=1699f35c2dc6b5e3 base=0x00003c9076b8a000 name=libc++abi.so.1\ndso: id=b08681628058b008 base=0x0000658e5ed55000 name=libclang_rt.asan.so\ndso: id=55a64c0451145961 base=0x00006c057703f000 name=\ndso: id=4356ccc3a83a32f6 base=0x0000772e1a24f000 name=libfdio.so\ndso: id=fa543fd6e28902aa base=0x00005e203627a000 name=libc.so\n=================================================================\nERROR: AddressSanitizer: heap-buffer-overflow on address 0x663fa3bcf198 at pc 0x71dc39153f4d bp 0x22cd5214c7d0 sp 0x22c\nd5214c7c8\nWRITE of size 1 at 0x663fa3bcf198 thread T0 (initial-thread)\n #0 0x000071dc39153f4c in foo_function(unsigned char const*, unsigned long) ../../out/default/../../examples/fuzzer/toy.cc:12 <>+0xacf4c\n #1.1 0x0000658e5ed9863c in Unwind ../recipe_cleanup/clangmRcYL3/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/asan/../sanitizer_common/sanitizer_stacktrace.h:115 +0x4363c\n #1 0x0000658e5ed9863c in __asan::ErrorGeneric::Print() ../recipe_cleanup/clangmRcYL3/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/asan/asan_errors.cc:585 +0x4363c\n #2 0x0000658e5eda2156 in __asan::ScopedInErrorReport::~ScopedInErrorReport() ../recipe_cleanup/clangmRcYL3/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/asan/asan_report.cc:141 +0x4d156\n #3 0x0000658e5eda3a1e in __asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) ../recipe_cleanup/clangmRcYL3/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/asan/asan_report.cc:470 +0x4ea1e\n #4 0x0000658e5eda441a in __asan_report_store1 ../recipe_cleanup/clangmRcYL3/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/asan/asan_rtl.cc:122 +0x4f41a\n #5 0x000071dc39153f4c in foo_function(unsigned char const*, unsigned long) ../../out/default/../../examples/fuzzer/toy.cc:12 <>+0xacf4c\n #6 0x000071dc39153ffc in bar_function(unsigned char const*, unsigned long) ../../out/default/../../examples/fuzzer/toy.cc:21 <>+0xacffc\n #7 0x000071dc3915403a in LLVMFuzzerTestOneInput ../../out/default/../../examples/fuzzer/toy.cc:25 <>+0xad03a\n #8 0x000071dc39104b93 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) <>+0x5db93\n #9 0x000071dc39106936 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::Fuzzer::vector >&) <>+0x5f936\n #10 0x000071dc39106f37 in fuzzer::Fuzzer::Loop(std::Fuzzer::vector >&) <>+0x5ff37\n #11 0x000071dc390f7118 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) <>+0x50118\n #12 0x000071dc3911dc02 in main ../recipe_cleanup/clangmRcYL3/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19 <>+0x76c02\n #13 0x00005e20363104de in start_main ../../out/default.zircon/../../zircon/third_party/ulib/musl/src/env/__libc_start_main.c:95 +0x964de\n0x663fa3bcf198 is located 7 bytes to the right of 1-byte region [0x663fa3bcf190,0x663fa3bcf191)\nallocated by thread T0 (initial-thread) here:\n #0 0x0000658e5ed9f5bd in malloc ../recipe_cleanup/clangmRcYL3/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/asan/asan_malloc_linux.cc:145 +0x4a5bd\n #1 0x000071dc39153f07 in foo_function(unsigned char const*, unsigned long) ../../out/default/../../examples/fuzzer/toy.cc:11 <>+0xacf07\n #2 0x000071dc39153ffc in bar_function(unsigned char const*, unsigned long) ../../out/default/../../examples/fuzzer/toy.cc:21 <>+0xacffc\n #3 0x000071dc3915403a in LLVMFuzzerTestOneInput ../../out/default/../../examples/fuzzer/toy.cc:25 <>+0xad03a\n #4 0x000071dc39104b93 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) <>+0x5db93\nSUMMARY: AddressSanitizer: heap-buffer-overflow foo_function(unsigned char const*, unsigned long) at ../../out/default/../../examples/fuzzer/toy.cc:12\nShadow bytes around the buggy address:\n 0x0cc7f4779de0: 00 00 00 00 00 00\u001b\n[0m 00 00 00 00 00 00 00\n 00 00 00\n 0x0cc7f4779df0: 00 00 00 00 00 00\u001b\n[0m 00 00 00 00 00 00 00\n 00 00 00\n 0x0cc7f4779e00: fa fa 00 00 fa fa\u001b\n[1m 00 00 fa fa 00 00 \nfa fa 00 00\n 0x0cc7f4779e10: fa fa 00 fa fa fa\n 00 fa fa fa 00 fa \u001b\n[1mfa fa 00 fa\n 0x0cc7f4779e20: fa fa 00 fa fa fa\n 00 00 fa fa 00 fa \nfa fa 01 fa\n=>0x0cc7f4779e30: fa fa 01[fa]fa fa\n fa fa fa fa fa fa\n fa fa fa fa\n 0x0cc7f4779e40: fa fa fa fa fa f\na fa fa fa fa fa fa\n fa fa fa fa\n 0x0cc7f4779e50: fa fa fa fa fa f\na fa fa fa fa fa fa\n fa fa fa fa\n 0x0cc7f4779e60: fa fa fa fa fa f\na fa fa fa fa fa fa\n fa fa fa fa\n 0x0cc7f4779e70: fa fa fa fa fa f\na fa fa fa fa fa fa\n fa fa fa fa\n 0x0cc7f4779e80: fa fa fa fa fa f\na fa fa fa fa fa fa\n fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 \n06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\nABORTING\n\nMS: 0 ; base unit: 0000000000000000000000000000000000000000\n\n\nartifact_prefix='data/'; Test unit written to data/crash-da39a3ee5e6b4b0d3255bfef95601890afd80709\nBase64: \n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/fuchsia_ignore.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@fuchsia_ignore.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/fuchsia_ignore.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@fuchsia_ignore.txt.snap index 1006f460b4..893d26f636 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/fuchsia_ignore.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@fuchsia_ignore.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/fuchsia_ignore.txt +--- { "text": "==48070== ERROR: libFuzzer: deadly signal\nWarning: Permanently added '[localhost]:57591' (ED25519) to the list of known hosts.\nINFO: Seed: 2797547935\nINFO: Loaded 3 modules (40851 inline 8-bit counters): 10 [0x2318cae62000, 0x2318cae6200a), 10773 [0x22acdc2a9360, 0x22acdc2abd75), 30068 [0x227defd5e520, 0x227defd65a94), \nINFO: Loaded 3 PC tables (40851 PCs): 10 [0x2318cae62010,0x2318cae620b0), 10773 [0x22acdc2abd78,0x22acdc2d5ec8), 30068 [0x227defd65a98,0x227defddb1d8), \n==48070== INFO: libFuzzer starting.\n/pkg/bin/frame-scheduler-fuzzer: Running 1 inputs 100 time(s) each.\n==48070== INFO: libFuzzer starting.\n #0 0x0000231322dc0d71 in +0x56d71 \n #1 0x0000231322dc0d9e in +0x56d9e \n #2 0x0000227def927355 in fuzzer::PrintStackTrace() <>+0x21d355\n #3 0x0000227def90d6a9 in fuzzer::Fuzzer::CrashCallback() <>+0x2036a9\n #4 0x0000227def927425 in fuzzer::(anonymous namespace)::StaticCrashHandler() ../recipe_cleanup/clang4jtbYR/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/fuzzer/FuzzerUtilFuchsia.cpp:186 <>+0x21d425\n #5 0x0000227def927415 in CrashTrampolineAsm <>+0x21d415\n #6 0x0000408982ea9aa8 in libc_io_functions_not_implemented_use_fdio_instead ../../out/clusterfuchsia-8880822439957731232.zircon/../../zircon/third_party/ulib/scudo/fuchsia.cc:34 +0x6eaa8\n #7 0x000023029f880e90 in fx_logger::VLogWrite(int, char const*, char const*, __va_list_tag*, bool) ../../out/clusterfuchsia-8880822439957731232.zircon/../../zircon/system/ulib/syslog/fx_logger.cc:223 +0x8e90\n #8.3 0x000023029f881ccf in fidl::internal::Walker<(anonymous namespace)::FidlValidator>::Frame::Frame(fidl_type const*, (anonymous namespace)::Position) ../../out/clusterfuchsia-8880822439957731232.zircon/../../zircon/system/ulib/fidl/include/lib/fidl/walker.h:197 +0x9ccf\n #8.2 0x000023029f881ccf in fidl::internal::Walker<(anonymous namespace)::FidlValidator>::Walk((anonymous namespace)::FidlValidator&) ../../out/clusterfuchsia-8880822439957731232.zircon/../../zircon/system/ulib/fidl/include/lib/fidl/walker.h:686 +0x9ccf\n #8.1 0x000023029f881ccf in void fidl::Walk<(anonymous namespace)::FidlValidator>((anonymous namespace)::FidlValidator&, fidl_type const*, (anonymous namespace)::FidlValidator::StartingPoint) ../../out/clusterfuchsia-8880822439957731232.zircon/../../zircon/system/ulib/fidl/include/lib/fidl/walker.h:925 +0x9ccf\n #8 0x000023029f881ccf in fx_logger_log ../../out/clusterfuchsia-8880822439957731232.zircon/../../zircon/system/ulib/fidl/validating.cc:222 +0x9ccf\n #9 0x0000227defa51fcf in syslog::LogMessage::~LogMessage() ../../out/clusterfuchsia-8880822439957731232/../../sdk/lib/syslog/cpp/macros.cc:101 <>+0x347fcf\n #10 0x0000227def97f41a in frame::Fake::Fake() ../../out/clusterfuchsia-8880822439957731232/../../path:150 <>+0x27541a\n #11 0x0000227def97d13a in frame::Fake::Fake2() ../../out/clusterfuchsia-8880822439957731232/../../path:307 <>+0x27313a\n #14.1 0x0000227defcabd29 in DispatchNextDueMessage ../../out/clusterfuchsia-8880822439957731232/../../zircon/system/ulib/async-testing/test_loop.cc:61 <>+0x5a1d29\n #14 0x0000227defcabd29 in async::TestLoop::Run() ../../out/clusterfuchsia-8880822439957731232/../../zircon/system/ulib/async-testing/test_loop.cc:259 <>+0x5a1d29\n #15.1 0x0000227defcac925 in RunUntil ../../out/clusterfuchsia-8880822439957731232/../../zircon/system/ulib/async-testing/test_loop.cc:188 <>+0x5a2925\n #15 0x0000227defcac925 in async::TestLoop::RunUntilIdle() ../../out/clusterfuchsia-8880822439957731232/../../zircon/system/ulib/async-testing/test_loop.cc:196 <>+0x5a2925\n #16 0x0000227def94cfe3 in LLVMFuzzerTestOneInput ../../out/clusterfuchsia-8880822439957731232/../../path:20 <>+0x242fe3\n #17 0x0000227def90ebc5 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) <>+0x204bc5\n #18 0x0000227def8fa594 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) ../recipe_cleanup/clang4jtbYR/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:296 <>+0x1f0594\n #19 0x0000227def900534 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) <>+0x1f6534\n #20 0x0000227def928a52 in main ../recipe_cleanup/clang4jtbYR/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19 <>+0x21ea52\n #21 0x0000408982ece68a in start_main ../../out/clusterfuchsia-8880822439957731232.zircon/../../zircon/third_party/ulib/musl/src/env/__libc_start_main.c:112 +0x9368a\n\n", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/fuchsia_reproducible_crash.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@fuchsia_reproducible_crash.txt.snap similarity index 97% rename from src/agent/libclusterfuzz/data/parsed-traces/fuchsia_reproducible_crash.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@fuchsia_reproducible_crash.txt.snap index 45fe7a6f08..836e72798b 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/fuchsia_reproducible_crash.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@fuchsia_reproducible_crash.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/fuchsia_reproducible_crash.txt +--- { "text": "==14454== ERROR: libFuzzer: deadly signal\nWarning: Permanently added '[localhost.corp.google.com]:53263' (ED25519) to the list of known hosts.\nINFO: Seed: 3976025544\nINFO: Loaded 1 modules (14 inline 8-bit counters): 14 [0x5332f2cf8090, 0x5332f2cf809e),\nINFO: Loaded 1 PC tables (14 PCs): 14 [0x5332f2cf80a0,0x5332f2cf8180),\nINFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes\nINFO: A corpus is not provided, starting from an empty corpus\n#2\tINITED cov: 5 ft: 5 corp: 1/1b exec/s: 0 rss: 30Mb\n#225\tNEW cov: 6 ft: 6 corp: 2/2b lim: 6 exec/s: 0 rss: 30Mb L: 1/1 MS: 3 ChangeBit-ShuffleBytes-ChangeBit-\n#239\tNEW cov: 7 ft: 7 corp: 3/8b lim: 6 exec/s: 0 rss: 30Mb L: 6/6 MS: 4 InsertByte-CMP-ChangeByte-CrossOver- DE: \"\\x01\\x00\\x00\\x00\"-\n#270\tREDUCE cov: 7 ft: 7 corp: 3/7b lim: 6 exec/s: 0 rss: 30Mb L: 5/5 MS: 1 EraseBytes-\n#309\tREDUCE cov: 7 ft: 7 corp: 3/5b lim: 6 exec/s: 0 rss: 30Mb L: 3/3 MS: 4 CopyPart-CopyPart-EraseBytes-EraseBytes-\n#396\tREDUCE cov: 8 ft: 8 corp: 4/8b lim: 6 exec/s: 0 rss: 30Mb L: 3/3 MS: 2 CopyPart-ChangeBit-\n#464\tNEW cov: 9 ft: 9 corp: 5/10b lim: 6 exec/s: 0 rss: 30Mb L: 2/3 MS: 3 CopyPart-EraseBytes-EraseBytes-\n#520\tREDUCE cov: 9 ft: 9 corp: 5/9b lim: 6 exec/s: 0 rss: 30Mb L: 2/3 MS: 1 EraseBytes-\n==14454== ERROR: libFuzzer: deadly signal\nNOTE: libFuzzer has rudimentary signal handlers.\n Combine libFuzzer with AddressSanitizer or similar for better crash reports.\nSUMMARY: libFuzzer: deadly signal\nWarning: Permanently added '[localhost.corp.google.com]:53263' (ED25519) to the list of known hosts.\ndso: id=88668a286c5c0e12 base=0x00005332f2c44000 name=/pkg/bin/basic_fuzzer\ndso: id=b715d488354a413b base=0x00005a9510140000 name=libc++.so.2\ndso: id=a889bd8ebd385a59 base=0x000058554cfe3000 name=libunwind.so.1\ndso: id=1699f35c2dc6b5e3 base=0x0000237685d86000 name=libc++abi.so.1\ndso: id=b08681628058b008 base=0x00004329b78bc000 name=libclang_rt.asan.so\ndso: id=0baa718c4f9739dc base=0x00007b70dbada000 name=\ndso: id=4e7da3de6c4cacb2 base=0x00007bc363909000 name=libfdio.so\ndso: id=46e83932b8bc1add base=0x00007602e25fb000 name=libc.so\n #0 0x00004329b790d331 in __sanitizer_print_stack_trace ../recipe_cleanup/clangmRcYL3/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/asan/asan_stack.cc:86 +0x51331\n #1.1 0x00004329b790d35e in Unwind ../recipe_cleanup/clangmRcYL3/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/asan/../sanitizer_common/sanitizer_stacktrace.h:115 +0x5135e\n #1 0x00004329b790d35e in __sanitizer_print_stack_trace ../recipe_cleanup/clangmRcYL3/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/asan/asan_stack.cc:86 +0x5135e\n #2 0x00005332f2cb9a95 in fuzzer::PrintStackTrace() <>+0x75a95\n #3 0x00005332f2ca0579 in fuzzer::Fuzzer::CrashCallback() <>+0x5c579\n #4 0x00005332f2cb9c25 in fuzzer::(anonymous namespace)::StaticCrashHandler() ../recipe_cleanup/clangmRcYL3/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/fuzzer/FuzzerUtilFuchsia.cpp:164 <>+0x75c25\n #5 0x00005332f2cb9c0e in CrashTrampolineAsm <>+0x75c0e\n #6 0x00005332f2cf10f1 in foo_function(unsigned char const*, unsigned long) ../../out/default/../../examples/fuzzer/basic.cc:12 <>+0xad0f1\n #7 0x00005332f2cf11ac in bar_function(unsigned char const*, unsigned long) ../../out/default/../../examples/fuzzer/basic.cc:21 <>+0xad1ac\n #8 0x00005332f2cf11ea in LLVMFuzzerTestOneInput ../../out/default/../../examples/fuzzer/basic.cc:25 <>+0xad1ea\n #9 0x00005332f2ca1b93 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) <>+0x5db93\n #10 0x00005332f2ca1394 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) <>+0x5d394\n #11 0x00005332f2ca3579 in fuzzer::Fuzzer::MutateAndTestOne() <>+0x5f579\n #12 0x00005332f2ca42c5 in fuzzer::Fuzzer::Loop(std::Fuzzer::vector >&) <>+0x602c5\n #13 0x00005332f2c94118 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) <>+0x50118\n #14 0x00005332f2cbac02 in main ../recipe_cleanup/clangmRcYL3/llvm_build_dir/tools/clang/stage2-bins/runtimes/runtimes-x86_64-unknown-fuchsia-bins/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19 <>+0x76c02\n #15 0x00007602e26925fe in start_main ../../out/default.zircon/../../zircon/third_party/ulib/musl/src/env/__libc_start_main.c:93 +0x975fe\n\nMS: 1 ChangeByte-; base unit: 6e41c5a19b9646fe31c77ed7a16829913888c33e\n0x48,0x49,0x21,\nHI!\nartifact_prefix='data/'; Test unit written to /usr/local/google/home/flowerhack/arash2/clusterfuzz/bot/resources/fuchsia/build/out/default/test_data/fuzzing/example_fuzzers/basic_fuzzer/2019-09-16T23:25:50.754886/crash-7a8dc3985d2a90fb6e62e94910fc11d31949c348\nBase64: SEkh\n", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/gdb_sigtrap_and_libfuzzer.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@gdb_sigtrap_and_libfuzzer.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/gdb_sigtrap_and_libfuzzer.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@gdb_sigtrap_and_libfuzzer.txt.snap index 18827bd0aa..98417bd072 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/gdb_sigtrap_and_libfuzzer.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@gdb_sigtrap_and_libfuzzer.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/gdb_sigtrap_and_libfuzzer.txt +--- { "text": "0x0000000000000ac8 in __aeabi_memcpy ()\n\nProgram received signal SIGTRAP, Trace/breakpoint trap.\n0x0000000000000ac8 in __aeabi_memcpy ()\n#0 0x0000000000000ac8 in __aeabi_memcpy ()\n#1 0x00000000000007d8 in memcpy ()\n#2 0x000000000000cdc0 in xymodem_trnasfer (target_addr=0x2022000, max_sz=, prot_type=1) at usbdev/protocol_xymodem.c:362\n#3 0x0000000000002060 in LoadImageFromUsb30 (uTargetAddr=, uSizeLimit=, req_type=3239010) at usbdev/usbdev_api.c:267\n#4 0x0000000000001fec in LoadBL1FromUsb30 () at usbdev/usbdev_api.c:225\n#5 0x0000000000004514 in Main () at boot/main.c:94\n#6 0x0000000000000044 in GPIO_SetPudBits (SFR_Address=, base=, mask=, value=) at gpio/gpio.c:38\n==111736== ERROR: libFuzzer: deadly signal\n #0 0x4b3520 in __sanitizer_print_stack_trace (/usr/local/google/home/xuanxing/Source/WhiteChapel/gsa-rom/external/emu/ap-rom/libfuzzer/fuzzer+0x4b3520)\n #1 0x45e158 in fuzzer::PrintStackTrace() (/usr/local/google/home/xuanxing/Source/WhiteChapel/gsa-rom/external/emu/ap-rom/libfuzzer/fuzzer+0x45e158)\n #2 0x4438c3 in fuzzer::Fuzzer::CrashCallback() (/usr/local/google/home/xuanxing/Source/WhiteChapel/gsa-rom/external/emu/ap-rom/libfuzzer/fuzzer+0x4438c3)\n #3 0x7f57fba5751f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1351f)\n #4 0x7f57fb74cf60 in raise (/lib/x86_64-linux-gnu/libc.so.6+0x39f60)\n #5 0x7f57fb738534 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x25534)\n #6 0x4b84d5 in cmd_kill(IGdbTarget*, int, char const*) /usr/local/google/home/xuanxing/Source/WhiteChapel/gsa-rom/external/emu/ap-rom/gdb.cpp:336:5\n #7 0x4b88ea in gdb_serve(int, IGdbTarget*) /usr/local/google/home/xuanxing/Source/WhiteChapel/gsa-rom/external/emu/ap-rom/gdb.cpp:379:26\n #8 0x4b85c0 in RunGDB(IGdbTarget*, int) /usr/local/google/home/xuanxing/Source/WhiteChapel/gsa-rom/external/emu/ap-rom/gdb.cpp:423:9\n #9 0x7f57fc5e296f (/lib/x86_64-linux-gnu/libstdc++.so.6+0xce96f)\n #10 0x7f57fba4cfb6 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8fb6)\n #11 0x7f57fb80d19e in clone (/lib/x86_64-linux-gnu/libc.so.6+0xfa19e)\n", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/glib_assert_failure.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@glib_assert_failure.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/glib_assert_failure.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@glib_assert_failure.txt.snap index a0f4275f3f..52966b0c52 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/glib_assert_failure.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@glib_assert_failure.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/glib_assert_failure.txt +--- { "text": "GLib:ERROR:../../src/glib/glib/gvariant-parser.c:709:ast_array_get_pattern: assertion failed: (j < i)\nUndefinedBehaviorSanitizer:DEADLYSIGNAL\n==1==ERROR: UndefinedBehaviorSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7f2c2a6aa428 bp 0x7ffd4a2c6d90 sp 0x7ffd4a2c6bf8 T1)\n #0 0x7f2c2a6aa427 in gsignal /build/glibc-Cl5G7W/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54\n #1 0x7f2c2a6ac029 in abort /build/glibc-Cl5G7W/glibc-2.23/stdlib/abort.c:89\n #2 0x447348 in g_assertion_message /src/glib/glib/gtestutils.c:2621:5\n #3 0x4473d3 in g_assertion_message_expr /src/glib/glib/gtestutils.c:2644:3\n #4 0x46c316 in ast_array_get_pattern /src/glib/glib/gvariant-parser.c:709:15\n #5 0x46bb76 in array_get_pattern /src/glib/glib/gvariant-parser.c:889:13\n #6 0x467ef9 in ast_resolve /src/glib/glib/gvariant-parser.c:595:13\n #7 0x467967 in g_variant_parse /src/glib/glib/gvariant-parser.c:2395:18\n #8 0x4336ce in LLVMFuzzerTestOneInput /src/glib/fuzzing/fuzz_variant_text.c:12:13\n #9 0x4b8948 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15\n #10 0x4a8f62 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6\n #11 0x4acbdb in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9\n #12 0x4a8ce8 in main /src/libfuzzer/FuzzerMain.cpp:20:10\n #13 0x7f2c2a69582f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291\n #14 0x408138 in _start\nUndefinedBehaviorSanitizer can not provide additional info.\nSUMMARY: UndefinedBehaviorSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x35427)\n==1==ABORTING\n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/golang_asan_panic.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_asan_panic.txt.snap similarity index 96% rename from src/agent/libclusterfuzz/data/parsed-traces/golang_asan_panic.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_asan_panic.txt.snap index 5ac89812c9..a055ae22bf 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/golang_asan_panic.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_asan_panic.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/golang_asan_panic.txt +--- { "text": "panic: asn1: string not valid UTF-8\n\ngoroutine 17 [running, locked to thread]:\ngithub.com/dvyukov/go-fuzz-corpus/asn1.Fuzz(0x603000009100, 0x16, 0x16, 0x7ffd132f5368)\n /src/go/packages/src/github.com/dvyukov/go-fuzz-corpus/asn1/asn1.go:46 +0x994\nmain.LLVMFuzzerTestOneInput(0x603000009100, 0x16, 0x9d2410)\n github.com/dvyukov/go-fuzz-corpus/asn1/go.fuzz.main/main.go:35 +0x66\nmain._cgoexpwrap_0a73695ed89a_LLVMFuzzerTestOneInput(0x603000009100, 0x16, 0x27a5b0)\n _cgo_gotypes.go:64 +0x37\n==42108== ERROR: libFuzzer: deadly signal\n #0 0x49f071 in __sanitizer_print_stack_trace /src/llvm/projects/compiler-rt/lib/asan/asan_stack.cpp:86:3\n #1 0x56236d in fuzzer::PrintStackTrace() /src/libfuzzer/FuzzerUtil.cpp:205:5\n #2 0x511cae in fuzzer::Fuzzer::CrashCallback() /src/libfuzzer/FuzzerLoop.cpp:232:3\n #3 0x7faa7c80b38f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1138f)\n #4 0x5c8a90 in runtime.raise runtime/sys_linux_amd64.s:149\n\nNOTE: libFuzzer has rudimentary signal handlers.\n Combine libFuzzer with AddressSanitizer or similar for better crash reports.\nSUMMARY: libFuzzer: deadly signal\n==42108==WARNING: ASan is ignoring requested __asan_handle_no_return: stack top: 0x7ffd132f9000; bottom 0x10c00015b000; size: 0x6f3d1319e000 (122308104151040)\nFalse positive error reports may follow\nFor details see https://github.com/google/sanitizers/issues/189\n", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/golang_fatal_error_stack_overflow.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_fatal_error_stack_overflow.txt.snap similarity index 96% rename from src/agent/libclusterfuzz/data/parsed-traces/golang_fatal_error_stack_overflow.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_fatal_error_stack_overflow.txt.snap index 4ee75318d2..c0ce8d3613 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/golang_fatal_error_stack_overflow.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_fatal_error_stack_overflow.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/golang_fatal_error_stack_overflow.txt +--- { "text": "runtime: goroutine stack exceeds 1000000000-byte limit\nfatal error: stack overflow\n\nruntime stack:\nruntime.throw(0x60f619, 0xe)\n/home/sdk/goroot/go/src/runtime/panic.go:619 +0x81\nruntime.newstack()\n/home/sdk/goroot/go/src/runtime/stack.go:1054 +0x71f\nruntime.morestack()\n/home/sdk/goroot/go/src/runtime/asm_amd64.s:480 +0x89\n\ngoroutine 34 [running]:\ngithub.com/google/syzkaller/pkg/ast.(*scanner).next(0xc420158000)\n/home/sdk/gopath/src/github.com/google/syzkaller/pkg/ast/scanner.go:271 +0x218 fp=0xc446ec03a8 sp=0xc446ec03a0 pc=0x5035c8\ngithub.com/google/syzkaller/pkg/ast.(*scanner).scanIdent(0xc420158000, 0xc4201502ea, 0x8, 0x492488, 0x1, 0x492489, 0x0, 0x0, 0x0)\n/home/sdk/gopath/src/github.com/google/syzkaller/pkg/ast/scanner.go:253 +0x2c fp=0xc446ec03f8 sp=0xc446ec03a8 pc=0x5031ac\ngithub.com/google/syzkaller/pkg/ast.(*scanner).Scan(0xc420158000, 0x50269b, 0xd, 0xc4201502ea, 0xc4201502ea, 0x8, 0x492488, 0x1, 0x492489)\n/home/sdk/gopath/src/github.com/google/syzkaller/pkg/ast/scanner.go:160 +0x3ab fp=0xc446ec04c8 sp=0xc446ec03f8 pc=0x50269b\ngithub.com/google/syzkaller/pkg/ast.(*parser).next(0xc466ebfce0)\n/home/sdk/gopath/src/github.com/google/syzkaller/pkg/ast/parser.go:154 +0x4b fp=0xc446ec0548 sp=0xc446ec04c8 pc=0x4fecfb\ngithub.com/google/syzkaller/pkg/ast.(*parser).tryConsume(0xc466ebfce0, 0xd, 0xc4201502ea)\n/home/sdk/gopath/src/github.com/google/syzkaller/pkg/ast/parser.go:166 +0x48 fp=0xc446ec0560 sp=0xc446ec0548 pc=0x4fee88\ngithub.com/google/syzkaller/pkg/ast.(*parser).parseTypeList(0xc466ebfce0, 0x13, 0x0, 0x492487)\n/home/sdk/gopath/src/github.com/google/syzkaller/pkg/ast/parser.go:446 +0x38 fp=0xc446ec05d0 sp=0xc446ec0560 pc=0x501498\ngithub.com/google/syzkaller/pkg/ast.(*parser).parseType(0xc466ebfce0, 0xd)\n/home/sdk/gopath/src/github.com/google/syzkaller/pkg/ast/parser.go:440 +0xd4 fp=0xc446ec0640 sp=0xc446ec05d0 pc=0x5011b4\ngithub.com/google/syzkaller/pkg/ast.(*parser).parseTypeList(0xc466ebfce0, 0x13, 0x0, 0x492485)\n/home/sdk/gopath/src/github.com/google/syzkaller/pkg/ast/parser.go:447 +0x53 fp=0xc446ec06b0 sp=0xc446ec0640 pc=0x5014b3\ngithub.com/google/syzkaller/pkg/ast.(*parser).parseType(0xc466ebfce0, 0xd)\n/home/sdk/gopath/src/github.com/google/syzkaller/pkg/ast/parser.go:440 +0xd4 fp=0xc446ec0720 sp=0xc446ec06b0 pc=0x5011b4\ngithub.com/google/syzkaller/pkg/ast.(*parser).parseTypeList(0xc466ebfce0, 0x13, 0x0, 0x492483)\n/home/sdk/gopath/src/github.com/google/syzkaller/pkg/ast/parser.go:447 +0x53 fp=0xc446ec0790 sp=0xc446ec0720 pc=0x5014b3\ngithub.com/google/syzkaller/pkg/ast.(*parser).parseType(0xc466ebfce0, 0xd)\n/home/sdk/gopath/src/github.com/google/syzkaller/pkg/ast/parser.go:440 +0xd4 fp=0xc446ec0800 sp=0xc446ec0790 pc=0x5011b4\n...additional frames elided...\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x0000005c1eb1 bp 0x7fff2cb506c8 sp 0x7fff2cb506b0 T0)\nSCARINESS: 10 (signal)\n #0 0x5c1eb0 in runtime.raise /tmp/go-fuzz-build988081626/goroot/src/runtime/sys_linux_amd64.s:149\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_syzkaller_74016d8d932a99eb2395761e6f76a07b59ae7a87/revisions/compiler_fuzzer+0x5c1eb0)\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/golang_generic_fatal_error_and_asan_abrt.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_generic_fatal_error_and_asan_abrt.txt.snap similarity index 92% rename from src/agent/libclusterfuzz/data/parsed-traces/golang_generic_fatal_error_and_asan_abrt.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_generic_fatal_error_and_asan_abrt.txt.snap index f6d18f570e..b9af03d0e8 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/golang_generic_fatal_error_and_asan_abrt.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_generic_fatal_error_and_asan_abrt.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/golang_generic_fatal_error_and_asan_abrt.txt +--- { "text": "fatal error: error message here\n\ngoroutine 17 [running, locked to thread]:\nencoding/json.(*decodeState).unquoteBytes(0x10c000096420, 0x10c00001c568, 0x1, 0x8, 0x0, 0x0, 0x0, 0x0)\n /src/go/src/encoding/json/decode.go:1264 +0xb3b\nmain.LLVMFuzzerTestOneInput(0x6050000001d0, 0xa, 0x9b1ad0)\n github.com/dvyukov/go-fuzz-corpus/json/go.fuzz.main/main.go:35 +0x66\nmain._cgoexpwrap_e34c4d0cdb90_LLVMFuzzerTestOneInput(0x6050000001d0, 0xa, 0x2758b0)\n _cgo_gotypes.go:64 +0x37\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x0000005c1a81 bp 0x10c0000bd628 sp 0x10c0000bd610 T0)\nSCARINESS: 10 (signal)\n #0 0x5c1a80 in runtime.raise runtime/sys_linux_amd64.s:149\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_golang_d17eb352b38c4d62fce2871b0afb04af926c5e25/revisions/fuzzer-json+0x5c1a80)\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/golang_generic_panic_and_asan_abrt.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_generic_panic_and_asan_abrt.txt.snap similarity index 92% rename from src/agent/libclusterfuzz/data/parsed-traces/golang_generic_panic_and_asan_abrt.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_generic_panic_and_asan_abrt.txt.snap index 574c1b49d9..ce7b7c9c83 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/golang_generic_panic_and_asan_abrt.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_generic_panic_and_asan_abrt.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/golang_generic_panic_and_asan_abrt.txt +--- { "text": "panic: error message here\n\ngoroutine 17 [running, locked to thread]:\nencoding/json.(*decodeState).unquoteBytes(0x10c000096420, 0x10c00001c568, 0x1, 0x8, 0x0, 0x0, 0x0, 0x0)\n /src/go/src/encoding/json/decode.go:1264 +0xb3b\nmain.LLVMFuzzerTestOneInput(0x6050000001d0, 0xa, 0x9b1ad0)\n github.com/dvyukov/go-fuzz-corpus/json/go.fuzz.main/main.go:35 +0x66\nmain._cgoexpwrap_e34c4d0cdb90_LLVMFuzzerTestOneInput(0x6050000001d0, 0xa, 0x2758b0)\n _cgo_gotypes.go:64 +0x37\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x0000005c1a81 bp 0x10c0000bd628 sp 0x10c0000bd610 T0)\nSCARINESS: 10 (signal)\n #0 0x5c1a80 in runtime.raise runtime/sys_linux_amd64.s:149\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_golang_d17eb352b38c4d62fce2871b0afb04af926c5e25/revisions/fuzzer-json+0x5c1a80)\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/golang_libfuzzer_panic.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_libfuzzer_panic.txt.snap similarity index 85% rename from src/agent/libclusterfuzz/data/parsed-traces/golang_libfuzzer_panic.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_libfuzzer_panic.txt.snap index 0db86c84a4..ddc3178eb1 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/golang_libfuzzer_panic.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_libfuzzer_panic.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/golang_libfuzzer_panic.txt +--- { "text": "panic: parse //%B9%B9%B9%B9%B9%01%00%00%00%00%00%00%00%B9%B9%B9%B9%B9%B9%B9%B9%B9%B9%B9%B9%B9%B9%B9: invalid URL escape \"%01\"\n\ngoroutine 17 [running, locked to thread]:\ngithub.com/dvyukov/go-fuzz-corpus/url.Fuzz(0x6030001458a0, 0x20, 0x20, 0x10c0000c8ea0)\n /tmp/go-fuzz-build242808228/gopath/src/github.com/dvyukov/go-fuzz-corpus/url/main.go:24 +0x3d5\nmain.fuzzer_run(0x6030001458a0, 0x20, 0x20)\n /tmp/go-fuzz-build242808228/gopath/src/github.com/dvyukov/go-fuzz-corpus/url/go.fuzz.main/main.go:13 +0x41\nmain._cgoexpwrap_9bd49841752b_fuzzer_run(0x6030001458a0, 0x20, 0x20)\n _cgo_gotypes.go:45 +0x41\n==158476== ERROR: libFuzzer: deadly signal\n", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/golang_new_crash_type_and_asan_abrt.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_new_crash_type_and_asan_abrt.txt.snap similarity index 92% rename from src/agent/libclusterfuzz/data/parsed-traces/golang_new_crash_type_and_asan_abrt.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_new_crash_type_and_asan_abrt.txt.snap index 56c5d2444f..ec7ad6a41e 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/golang_new_crash_type_and_asan_abrt.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_new_crash_type_and_asan_abrt.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/golang_new_crash_type_and_asan_abrt.txt +--- { "text": "unknown error: error message here\n\ngoroutine 17 [running, locked to thread]:\nencoding/json.(*decodeState).unquoteBytes(0x10c000096420, 0x10c00001c568, 0x1, 0x8, 0x0, 0x0, 0x0, 0x0)\n /src/go/src/encoding/json/decode.go:1264 +0xb3b\nmain.LLVMFuzzerTestOneInput(0x6050000001d0, 0xa, 0x9b1ad0)\n github.com/dvyukov/go-fuzz-corpus/json/go.fuzz.main/main.go:35 +0x66\nmain._cgoexpwrap_e34c4d0cdb90_LLVMFuzzerTestOneInput(0x6050000001d0, 0xa, 0x2758b0)\n _cgo_gotypes.go:64 +0x37\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x0000005c1a81 bp 0x10c0000bd628 sp 0x10c0000bd610 T0)\nSCARINESS: 10 (signal)\n #0 0x5c1a80 in runtime.raise runtime/sys_linux_amd64.s:149\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_golang_d17eb352b38c4d62fce2871b0afb04af926c5e25/revisions/fuzzer-json+0x5c1a80)\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/golang_panic_runtime_error_index_out_of_range_with_msan.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_panic_runtime_error_index_out_of_range_with_msan.txt.snap similarity index 92% rename from src/agent/libclusterfuzz/data/parsed-traces/golang_panic_runtime_error_index_out_of_range_with_msan.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_panic_runtime_error_index_out_of_range_with_msan.txt.snap index 6379577f7e..fc51c1184f 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/golang_panic_runtime_error_index_out_of_range_with_msan.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_panic_runtime_error_index_out_of_range_with_msan.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/golang_panic_runtime_error_index_out_of_range_with_msan.txt +--- { "text": "panic: runtime error: index out of range\ngoroutine 108 [running]:\nnet/http.(*conn).serve.func1(0xc420115a40)\n /syzkaller/go/src/net/http/server.go:1726 +0xd0\npanic(0xc30720, 0x144ca60)\n /syzkaller/go/src/runtime/panic.go:502 +0x229\nmain.(*Manager).httpPrio(0xc4201dab60, 0xf2dac0, 0xc4211800e0, 0xc4203bc200)\n /syzkaller/gopath/src/github.com/google/syzkaller/syz-manager/html.go:298 +0x5f4\nmain.(*Manager).(main.httpPrio)-fm(0xf2dac0, 0xc4211800e0, 0xc4203bc200)\n /syzkaller/gopath/src/github.com/google/syzkaller/syz-manager/html.go:37 +0x48\nnet/http.HandlerFunc.ServeHTTP(0xc420272400, 0xf2dac0, 0xc4211800e0, 0xc4203bc200)\n /syzkaller/go/src/net/http/server.go:1947 +0x44\nnet/http.(*ServeMux).ServeHTTP(0x2e82ba0, 0xf2dac0, 0xc4211800e0, 0xc4203bc200)\n /syzkaller/go/src/net/http/server.go:2337 +0x130\nnet/http.serverHandler.ServeHTTP(0xc4203ac000, 0xf2dac0, 0xc4211800e0, 0xc4203bc200)\n /syzkaller/go/src/net/http/server.go:2694 +0xbc\nnet/http.(*conn).serve(0xc420115a40, 0xf2e540, 0xc420134800)\n /syzkaller/go/src/net/http/server.go:1830 +0x651\ncreated by net/http.(*Server).Serve\n /syzkaller/go/src/net/http/server.go:2795 +0x27b\nMemorySanitizer:DEADLYSIGNAL\n==682278==ERROR: MemorySanitizer: ABRT on unknown address 0x0539000a6926 (pc 0x55a0c2ff2761 bp 0x00c0000527e8 sp 0x00c0000527d0 T682278)\n #0 0x55a0c2ff2761 in runtime.raise /syzkaller/go/gc/src/runtime/sys_linux_amd64.s:165\nMemorySanitizer can not provide additional info.\nSUMMARY: MemorySanitizer: ABRT (/fuzzer+0x1116761)\n==682278==ABORTING", "sanitizer": "MemorySanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/golang_panic_runtime_error_slice_bounds_out_of_range.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_panic_runtime_error_slice_bounds_out_of_range.txt.snap similarity index 94% rename from src/agent/libclusterfuzz/data/parsed-traces/golang_panic_runtime_error_slice_bounds_out_of_range.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_panic_runtime_error_slice_bounds_out_of_range.txt.snap index 482ea34c19..90456b49b5 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/golang_panic_runtime_error_slice_bounds_out_of_range.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@golang_panic_runtime_error_slice_bounds_out_of_range.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/golang_panic_runtime_error_slice_bounds_out_of_range.txt +--- { "text": "panic: runtime error: slice bounds out of range [1:0]\ngoroutine 17 [running, locked to thread]:\nencoding/json.(*decodeState).unquoteBytes(0x10c000096420, 0x10c00001c568, 0x1, 0x8, 0x0, 0x0, 0x0, 0x0)\n /src/go/src/encoding/json/decode.go:1264 +0xb3b\nencoding/json.(*decodeState).literalStore(0x10c000096420, 0x10c00001c568, 0x1, 0x8, 0x9884a0, 0x10c00009c0f0, 0x182, 0x1, 0x9aafe0, 0x10c00009c000)\n /src/go/src/encoding/json/decode.go:1004 +0x23a5\nencoding/json.(*decodeState).object(0x10c000096420, 0x982a80, 0x10c00009c000, 0x16, 0x10c000096448, 0x60337b)\n /src/go/src/encoding/json/decode.go:833 +0x152d\nencoding/json.(*decodeState).value(0x10c000096420, 0x982a80, 0x10c00009c000, 0x16, 0x16, 0x22)\n /src/go/src/encoding/json/decode.go:446 +0xd3\nencoding/json.(*decodeState).unmarshal(0x10c000096420, 0x982a80, 0x10c00009c000, 0x10c000096448, 0x0)\n /src/go/src/encoding/json/decode.go:179 +0x2d3\nencoding/json.Unmarshal(0x6050000001d0, 0xa, 0xa, 0x982a80, 0x10c00009c000, 0x0, 0x0)\n /src/go/src/encoding/json/decode.go:106 +0x15c\ngithub.com/dvyukov/go-fuzz-corpus/json.Fuzz(0x6050000001d0, 0xa, 0xa, 0x7ffe5d47fe28)\n /src/go/packages/src/github.com/dvyukov/go-fuzz-corpus/json/json.go:23 +0x156\nmain.LLVMFuzzerTestOneInput(0x6050000001d0, 0xa, 0x9b1ad0)\n github.com/dvyukov/go-fuzz-corpus/json/go.fuzz.main/main.go:35 +0x66\nmain._cgoexpwrap_e34c4d0cdb90_LLVMFuzzerTestOneInput(0x6050000001d0, 0xa, 0x2758b0)\n _cgo_gotypes.go:64 +0x37\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x0000005c1a81 bp 0x10c0000bd628 sp 0x10c0000bd610 T0)\nSCARINESS: 10 (signal)\n #0 0x5c1a80 in runtime.raise runtime/sys_linux_amd64.s:149\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_golang_d17eb352b38c4d62fce2871b0afb04af926c5e25/revisions/fuzzer-json+0x5c1a80)\n==1==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/gsignal_at_first_stack_frame.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@gsignal_at_first_stack_frame.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/gsignal_at_first_stack_frame.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@gsignal_at_first_stack_frame.txt.snap index 3ebd4a7512..3db5ac4271 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/gsignal_at_first_stack_frame.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@gsignal_at_first_stack_frame.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/gsignal_at_first_stack_frame.txt +--- { "text": "[1222/164952:FATAL:ftp_util.cc(198)] Check failed: 1 == map_[ASCIIToUTF16(\"jan\")] (1 vs. 0)\n#0 0x000000466ef1 __interceptor_backtrace\n#1 0x0000015ac58a base::debug::StackTrace::StackTrace()\n#2 0x000001177e4c logging::LogMessage::~LogMessage()\n#3 0x0000010b9df0 net::FtpUtil::AbbreviatedMonthToNumber()\n#4 0x0000010be233 net::FtpUtil::LsDateListingToTime()\n#5 0x000001084fa9 net::ParseFtpDirectoryListingLs()\n#6 0x000001082006 net::ParseFtpDirectoryListing()\n#7 0x0000004e640a LLVMFuzzerTestOneInput\n#8 0x000001ff6eb8 fuzzer::RunOneTest()\n#9 0x000001ff8f42 fuzzer::FuzzerDriver()\n#10 0x000001ff7486 fuzzer::FuzzerDriver()\n#11 0x000001ff718b fuzzer::FuzzerDriver()\n#12 0x7ffb57addec5 __libc_start_main\n#13 0x0000004264e3 \n\nASAN:DEADLYSIGNAL\n=================================================================\n==96165==ERROR: AddressSanitizer: SEGV on unknown address 0x5668a000177a5 (pc 0x7ffb57af2cb7 bp 0x7ffe2246d7d0 sp 0x7ffe2246d698 T0)\n #0 0x7ffb57af2cb6 in gsignal /tmp/tmp.Htw1L27e9P/nptl/sysdeps/unix/sysv/linux/raise.c:56\n #1 0x1178a18 in logging::LogMessage::~LogMessage() base/logging.cc:721:7\n #2 0x10b9def in AbbreviatedMonthsMap net/ftp/ftp_util.cc:198:5\n #3 0x10b9def in New base/memory/singleton.h:53\n #4 0x10b9def in get base/memory/singleton.h:248\n #5 0x10b9def in GetInstance net/ftp/ftp_util.cc:135\n #6 0x10b9def in net::FtpUtil::AbbreviatedMonthToNumber(std::__1::basic_string > const&, int*) net/ftp/ftp_util.cc:223\n #7 0x10be232 in net::FtpUtil::LsDateListingToTime(std::__1::basic_string > const&, std::__1::basic_string > const&, std::__1::basic_string > const&, base::Time const&, base::Time*) net/ftp/ftp_util.cc:234:8\n #8 0x1084fa8 in DetectColumnOffsetSizeAndModificationTime net/ftp/ftp_directory_listing_parser_ls.cc:85:9\n #9 0x1084fa8 in net::ParseFtpDirectoryListingLs(std::__1::vector >, std::__1::allocator > > > const&, base::Time const&, std::__1::vector >*) net/ftp/ftp_directory_listing_parser_ls.cc:158\n #10 0x1082005 in Run base/callback.h:396:12\n #11 0x1082005 in ParseListing net/ftp/ftp_directory_listing_parser.cc:71\n #12 0x1082005 in DecodeAndParse net/ftp/ftp_directory_listing_parser.cc:101\n #13 0x1082005 in net::ParseFtpDirectoryListing(std::__1::basic_string, std::__1::allocator > const&, base::Time const&, std::__1::vector >*) net/ftp/ftp_directory_listing_parser.cc:129\n #14 0x4e6409 in LLVMFuzzerTestOneInput testing/libfuzzer/ftp_directory_listing_fuzzer.cc:16:3\n #15 0x1ff6eb7 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*) third_party/llvm/lib/Fuzzer/FuzzerDriver.cpp:189:3\n #16 0x1ff8f41 in fuzzer::FuzzerDriver(std::__1::vector, std::__1::allocator >, std::__1::allocator, std::__1::allocator > > > const&, fuzzer::UserSuppliedFuzzer&) third_party/llvm/lib/Fuzzer/FuzzerDriver.cpp:277:12\n #17 0x1ff7485 in fuzzer::FuzzerDriver(int, char**, fuzzer::UserSuppliedFuzzer&) third_party/llvm/lib/Fuzzer/FuzzerDriver.cpp:201:10\n #18 0x1ff718a in fuzzer::FuzzerDriver(int, char**, int (*)(unsigned char const*, unsigned long)) third_party/llvm/lib/Fuzzer/FuzzerDriver.cpp:196:10\n #19 0x7ffb57addec4 in __libc_start_main /tmp/tmp.Htw1L27e9P/csu/libc-start.c:287\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x36cb6)\n==96165==ABORTING\nDEATH:\n\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/hwasan_allocation_tail_overwritten.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@hwasan_allocation_tail_overwritten.txt.snap similarity index 95% rename from src/agent/libclusterfuzz/data/parsed-traces/hwasan_allocation_tail_overwritten.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@hwasan_allocation_tail_overwritten.txt.snap index e98a157fd3..9f15646a42 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/hwasan_allocation_tail_overwritten.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@hwasan_allocation_tail_overwritten.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/hwasan_allocation_tail_overwritten.txt +--- { "text": "==11246==ERROR: HWAddressSanitizer: allocation-tail-overwritten; heap object [0x00444b02b180,0x00444b02b182) of size 2\n #0 0x7e9aa0a3fc frame1\n #1 0x634b04d474 frame2\n #2 0x634b053238 frame3\nallocated here:\n #0 0x7e9aa09fa8 frame4\n #1 0x634b04c4f8 frame5\n #2 0x634b04d398 frame6\n\nTail contains: .. .. 80 80 80 80 80 80 dd 03 df 1d 71 dd 95 18\nExpected: .. .. d0 0d a4 56 0d c1 dd 03 df 1d 71 dd 95 46\n ^^ ^^ ^^ ^^ ^^ ^^ ^^\nThis error occurs when a buffer overflow overwrites memory\nto the right of a heap object, but within the 16-byte granule, e.g.\n char *x = new char[20];\n x[25] = 42;\nHWAddressSanitizer does not detect such bugs in uninstrumented code at the time of write,\nbut can detect them at the time of free/delete.\nTo disable this feature set HWASAN_OPTIONS=free_checks_tail_magic=0\nThread: T0 0x007500002000 stack: [0x007fcf489000,0x007fcfc89000) sz: 8388608 tls: [0x000000000000,0x000000000000)\nMemory tags around the buggy address (one tag corresponds to 16 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 08 00 38 08 c7 08 b6 08 66 00 08 00 08 00 3b 00\n=> 08 00 a7 a7 96 07 0f 00 [02] 00 02 00 00 00 00 00 <=\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nTags for short granules around the buggy address (one tag corresponds to 16 bytes):\n d2 .. .. 38 .. c7 .. b6 .. .. 74 .. 2c .. .. ..\n=> 20 .. .. .. .. 96 c8 .. [18] .. 1b .. .. .. .. .. <=\n .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..\nSee https://clang.llvm.org/docs/HardwareAssistedAddressSanitizerDesign.html#short-granules for a description of short granule tags\nSUMMARY: HWAddressSanitizer: alocation-tail-overwritten (/apex/com.android.runtime/lib64/bionic/libclang_rt.hwasan-aarch64-android.so+0x1b3fc)", "sanitizer": "HWAddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ignore_abort_frames.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_abort_frames.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/ignore_abort_frames.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_abort_frames.txt.snap index a9de9ab769..d947d3c106 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ignore_abort_frames.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_abort_frames.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ignore_abort_frames.txt +--- { "text": "==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7fb31a28e418 bp 0x7ffc4aa89af0 sp 0x7ffc4aa898b8 T0)\nSCARINESS: 10 (signal)\n #0 0x7fb31a28e417 in gsignal\n #1 0x7fb31a290019 in abort\n #2 0x583436 in abort_message\n #3 0x584c65 in demangling_terminate_handler()\n #4 0x5832d5 in std::__terminate(void (*)())\n #5 0x5847d6 in __cxa_throw\n #6 0x524dfd in nlohmann::basic_json, std::__1::allocator >, bool, long, unsigned long, double, std::__1::allocator, nlohmann::adl_serializer>::lexer::get_number(nlohmann::basic_json, std::__1::allocator >, bool, long, unsigned long, double, std::__1::allocator, nlohmann::adl_serializer>&, nlohmann::basic_json, std::__1::allocator >, bool, long, unsigned long, double, std::__1::allocator, nlohmann::adl_serializer>::lexer::token_type) const /src/json/src/json.hpp:11871:21\n #7 0x51b119 in nlohmann::basic_json, std::__1::allocator >, bool, long, unsigned long, double, std::__1::allocator, nlohmann::adl_serializer>::parser::parse_internal(bool) /src/json/src/json.hpp:12146:29\n #8 0x51be3a in nlohmann::basic_json, std::__1::allocator >, bool, long, unsigned long, double, std::__1::allocator, nlohmann::adl_serializer>::parser::parse_internal(bool) /src/json/src/json.hpp:12092:38\n #9 0x51a67f in nlohmann::basic_json, std::__1::allocator >, bool, long, unsigned long, double, std::__1::allocator, nlohmann::adl_serializer>::parser::parse() /src/json/src/json.hpp:11953:33\n #10 0x5132ec in nlohmann::basic_json, std::__1::allocator >, bool, long, unsigned long, double, std::__1::allocator, nlohmann::adl_serializer> nlohmann::basic_json, std::__1::allocator >, bool, long, unsigned long, double, std::__1::allocator, nlohmann::adl_serializer>::parse(unsigned char const*, unsigned char const*, std::__1::function, std::__1::allocator >, bool, long, unsigned long, double, std::__1::allocator, nlohmann::adl_serializer>::parse_event_t, nlohmann::basic_json, std::__1::allocator >, bool, long, unsigned long, double, std::__1::allocator, nlohmann::adl_serializer>&)>) /src/json/src/json.hpp:7244:40\n #11 0x512a40 in LLVMFuzzerTestOneInput /src/json/test/src/fuzzer-parse_json.cpp:34:19\n #12 0x512333 in main /src/libfuzzer/afl/afl_driver.cpp:287:7\n #13 0x7fb31a27982f in __libc_start_main\n #14 0x41b5d8 in _start\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x35417)\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ignore_honggfuzz.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_honggfuzz.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/ignore_honggfuzz.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_honggfuzz.txt.snap index 8ff7d8b180..6cc9344e82 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ignore_honggfuzz.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_honggfuzz.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ignore_honggfuzz.txt +--- { "text": "AddressSanitizer:DEADLYSIGNAL\n=================================================================\n==3921205==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x55f2fda19db0 bp 0x7fff42342520 sp 0x7fff42342500 T0)\n==3921205==The signal is caused by a READ memory access.\n==3921205==Hint: this fault was caused by a dereference of a high value address (see register values below). Dissassemble the provided pc to learn which register was used.\nSCARINESS: 20 (wild-addr-read)\n #0 0x55f2fda19db0 in HF_strcmp /proc/self/cwd/third_party/honggfuzz/libhfuzz/memorycmp.c:17:26\n #1 0x55f2fda19d8c in __wrap_strcmp /proc/self/cwd/third_party/honggfuzz/libhfuzz/memorycmp.c:146:12\n #2 0x55f2fd41dfc6 in function1 file1.c:486:12\n #3 0x55f2fd3392b1 in function2 file2.c:349:12\n #4 0x55f2fd4593b5 in function3 file3.c:906:21\n #5 0x55f2fd21672b in LLVMFuzzerTestOneInput /proc/self/cwd/fuzzer/fuzzer.cc:10:16\n #6 0x55f2fda1a7c8 in HonggfuzzRunOneInput /proc/self/cwd/third_party/honggfuzz/libhfuzz/persistent.c:60:15\n #7 0x55f2fda1a713 in HonggfuzzRunFromFile /proc/self/cwd/third_party/honggfuzz/libhfuzz/persistent.c:99:5\n #8 0x55f2fda1a5e7 in HonggfuzzMain /proc/self/cwd/third_party/honggfuzz/libhfuzz/persistent.c:109:16\n #8 0x55f2fda1a7b8 in main /proc/self/cwd/third_party/honggfuzz/libhfuzz/persistent.c:124:12\n #10 0x7f147a0e6bbc in __libc_start_main\n #11 0x55f2fd165488 in _start src/sysdeps/x86_64/start.S:108\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/mnt/scratch0/clusterfuzz/bot/builds/path_to_the-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/some-fuzzer+0xe28db0)\n==3921205==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ignore_libcplusplus.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_libcplusplus.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/ignore_libcplusplus.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_libcplusplus.txt.snap index 285a6a1789..a80f07cccd 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ignore_libcplusplus.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_libcplusplus.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ignore_libcplusplus.txt +--- { "text": "libc++abi.dylib: terminating with uncaught exception of type std::length_error: vector\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==29939==ERROR: AddressSanitizer: ABRT on unknown address 0x7fff94dd7f06 (pc 0x7fff94dd7f06 bp 0x7fff5a49dcd0 sp 0x7fff5a49dca8 T0)\nSCARINESS: 10 (signal)\n #0 0x7fff94dd7f05 in __pthread_kill\n #1 0x7fff8733c6de in abort\n #2 0x7fff8e1abc10 (/usr/lib/libc++abi.dylib:x86_64+0xc10)\n #3 0x7fff8e1d1dfe (/usr/lib/libc++abi.dylib:x86_64+0x26dfe)\n #2 0x7fff86bef4a5 in _objc_terminate()\n #5 0x7fff8e1cf00d (/usr/lib/libc++abi.dylib:x86_64+0x2400d)\n #6 0x7fff8e1cea79 (/usr/lib/libc++abi.dylib:x86_64+0x23a79)\n #7 0x7fff820ec726 (/usr/lib/libc++.1.dylib:x86_64+0x3a726)\n #3 0x1058ea0b7 in std::__1::vector, std::__1::allocator > >::__recommend(unsigned long) const third_party/llvm-build/Release+Asserts/include/c++/v1/vector:1010:15\n #4 0x1058e9bf0 in std::__1::vector, std::__1::allocator > >::__append(unsigned long) third_party/llvm-build/Release+Asserts/include/c++/v1/vector:1087:57\n #5 0x1058e4a36 in sfntly::BitmapSizeTable::Builder::Initialize(sfntly::ReadableFontData*) third_party/sfntly/src/cpp/src/sfntly/table/bitmap/bitmap_size_table.cc:465:23\n #6 0x1058e3308 in sfntly::BitmapSizeTable::Builder::GetIndexSubTableBuilders() third_party/sfntly/src/cpp/src/sfntly/table/bitmap/bitmap_size_table.cc:454:5\n #7 0x1057e11bc in (anonymous namespace)::InitializeBitmapBuilder(sfntly::EbdtTable::Builder*, sfntly::EblcTable::Builder*, std::__1::set, std::__1::allocator > const&) third_party/sfntly/src/cpp/src/sample/chromium/subsetter_impl.cc:324:24\n #8 0x1057e0653 in sfntly::SetupBitmapBuilders(sfntly::Font*, sfntly::Font::Builder*, std::__1::set, std::__1::allocator > const&) third_party/sfntly/src/cpp/src/sample/chromium/subsetter_impl.cc:607:8\n #9 0x1057e40da in sfntly::SubsetterImpl::Subset(std::__1::set, std::__1::allocator > const&, sfntly::GlyphTable*, sfntly::LocaTable*) third_party/sfntly/src/cpp/src/sample/chromium/subsetter_impl.cc:776:22\n #10 0x1057e2c4c in sfntly::SubsetterImpl::SubsetFont(unsigned int const*, unsigned long, unsigned char**) third_party/sfntly/src/cpp/src/sample/chromium/subsetter_impl.cc:685:19\n #11 0x1057df7ce in SfntlyWrapper::SubsetFont(char const*, unsigned char const*, unsigned long, unsigned int const*, unsigned long, unsigned char**) third_party/sfntly/src/cpp/src/sample/chromium/font_subsetter.cc:38:20\n #12 0x10576054f in LLVMFuzzerTestOneInput third_party/sfntly/fuzzers/subset_font_fuzzer.cc:35:3\n #13 0x10579676a in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:571:15\n #14 0x10576f876 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:280:6\n #15 0x1057744b6 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:713:9\n #16 0x1057b4c51 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10\n #17 0x7fff93ca35ac in start\n==29939==Register values:\nrax = 0x0000000000000000 rbx = 0x0000000000000006 rcx = 0x00007fff5a49dca8 rdx = 0x0000000000000000\nrdi = 0x000000000000050f rsi = 0x0000000000000006 rbp = 0x00007fff5a49dcd0 rsp = 0x00007fff5a49dca8\n r8 = 0x0000000000000001 r9 = 0x0000000000000008 r10 = 0x0000000008000000 r11 = 0x0000000000000206\nr12 = 0x00007fff5a49de30 r13 = 0x00001000217593c0 r14 = 0x00007fff72252000 r15 = 0x00007fff5a49dd10\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/usr/lib/system/libsystem_kernel.dylib:x86_64+0x16f05)\n==29939==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ignore_llvm.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_llvm.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/ignore_llvm.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_llvm.txt.snap index 3f4bb5e979..3223621ede 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ignore_llvm.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_llvm.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ignore_llvm.txt +--- { "text": "=================================================================\n==46471==ERROR: AddressSanitizer: heap-use-after-free on address 0x6120000746b0 at pc 0x000110615e7e bp 0x7fff58c768f0 sp 0x7fff58c768e8\nREAD of size 8 at 0x6120000746b0 thread T0\nSCARINESS: 51 (8-byte-read-heap-use-after-free)\n #0 0x110615e7d in size /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/__hash_table:807:55\n #1 0x110615e7d in bucket_count /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/__hash_table:1122\n #2 0x110615e7d in __emplace_unique_key_args, std::__1::tuple<> > /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/__hash_table:1953\n #3 0x110615e7d in std::__1::unordered_map, std::__1::equal_to, std::__1::allocator > >::operator[](cc::BeginFrameSource* const&) /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/unordered_map:1422\n #4 0x1106164b8 in cc::SurfaceManager::UnregisterBeginFrameSource(cc::BeginFrameSource*) /b/c/b/Mac_ASAN_Release_Media/src/cc/surfaces/surface_manager.cc:196:24\n #5 0x1105b76f5 in cc::Display::~Display() /b/c/b/Mac_ASAN_Release_Media/src/cc/surfaces/display.cc:57:25\n #6 0x1105b7f2a in ~Display /b/c/b/Mac_ASAN_Release_Media/src/cc/surfaces/display.cc:53:21\n #7 0x1105b7f2a in cc::Display::~Display() /b/c/b/Mac_ASAN_Release_Media/src/cc/surfaces/display.cc:53\n #8 0x10ba9498e in operator() /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2565:13\n #9 0x10ba9498e in reset /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2771\n #10 0x10ba9498e in ~unique_ptr /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2739\n #11 0x10ba9498e in ~unique_ptr /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2739\n #12 0x10ba9498e in ~PerCompositorData /b/c/b/Mac_ASAN_Release_Media/src/content/browser/compositor/gpu_process_transport_factory.cc:165\n #13 0x10ba9498e in ~PerCompositorData /b/c/b/Mac_ASAN_Release_Media/src/content/browser/compositor/gpu_process_transport_factory.cc:165\n #14 0x10ba9498e in operator() /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2565\n #15 0x10ba9498e in reset /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2771\n #16 0x10ba9498e in ~unique_ptr /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2739\n #17 0x10ba9498e in ~unique_ptr /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2739\n #18 0x10ba9498e in ~pair /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/utility:296\n #19 0x10ba9498e in ~pair /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/utility:296\n #20 0x10ba9498e in __destroy > > > /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:1699\n #21 0x10ba9498e in destroy > > > /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:1562\n #22 0x10ba9498e in std::__1::__tree > >, std::__1::__map_value_compare > >, std::__1::less, true>, std::__1::allocator > > > >::destroy(std::__1::__tree_node > >, void*>*) /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/__tree:1793\n #23 0x10ba882fe in ~GpuProcessTransportFactory /b/c/b/Mac_ASAN_Release_Media/src/content/browser/compositor/gpu_process_transport_factory.cc:190:59\n #24 0x10ba882fe in ~GpuProcessTransportFactory /b/c/b/Mac_ASAN_Release_Media/src/content/browser/compositor/gpu_process_transport_factory.cc:190\n #25 0x10ba882fe in non-virtual thunk to content::GpuProcessTransportFactory::~GpuProcessTransportFactory() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/compositor/gpu_process_transport_factory.cc:190\n #26 0x10ba98a09 in content::ImageTransportFactory::Terminate() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/compositor/image_transport_factory.cc:50:3\n #27 0x10aacbae3 in content::BrowserMainLoop::ShutdownThreadsAndCleanUp() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/browser_main_loop.cc:1027:5\n #28 0x10aad70a7 in content::BrowserMainRunnerImpl::Shutdown() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/browser_main_runner.cc:211:19\n #29 0x10be5663c in LayoutTestBrowserMain(content::MainFunctionParams const&, std::__1::unique_ptr > const&) /b/c/b/Mac_ASAN_Release_Media/src/content/shell/browser/layout_test/layout_test_browser_main.cc:149:16\n #30 0x10bdb32b7 in content::ShellMainDelegate::RunProcess(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&) /b/c/b/Mac_ASAN_Release_Media/src/content/shell/app/shell_main_delegate.cc:294:16\n #31 0x10a80434e in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) /b/c/b/Mac_ASAN_Release_Media/src/content/app/content_main_runner.cc:405:35\n #32 0x10a80702c in content::ContentMainRunnerImpl::Run() /b/c/b/Mac_ASAN_Release_Media/src/content/app/content_main_runner.cc:786:12\n #33 0x10a803613 in content::ContentMain(content::ContentMainParams const&) /b/c/b/Mac_ASAN_Release_Media/src/content/app/content_main.cc:20:28\n #34 0x106f922a4 in Content Shell Framework\n #35 0x106f86e03 in start\n0x6120000746b0 is located 240 bytes inside of 272-byte region [0x6120000745c0,0x6120000746d0)\nfreed by thread T0 here:\n #0 0x11fd23336 in __asan_memmove\n #1 0x10ba87e69 in operator() /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2565:13\n #2 0x10ba87e69 in reset /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2771\n #3 0x10ba87e69 in ~unique_ptr /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2739\n #4 0x10ba87e69 in ~unique_ptr /b/c/b/Mac_ASAN_Release_Media/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2739\n #5 0x10ba87e69 in content::GpuProcessTransportFactory::~GpuProcessTransportFactory() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/compositor/gpu_process_transport_factory.cc:197\n #6 0x10ba882fe in ~GpuProcessTransportFactory /b/c/b/Mac_ASAN_Release_Media/src/content/browser/compositor/gpu_process_transport_factory.cc:190:59\n #7 0x10ba882fe in ~GpuProcessTransportFactory /b/c/b/Mac_ASAN_Release_Media/src/content/browser/compositor/gpu_process_transport_factory.cc:190\n #8 0x10ba882fe in non-virtual thunk to content::GpuProcessTransportFactory::~GpuProcessTransportFactory() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/compositor/gpu_process_transport_factory.cc:190\n #9 0x10ba98a09 in content::ImageTransportFactory::Terminate() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/compositor/image_transport_factory.cc:50:3\n #10 0x10aacbae3 in content::BrowserMainLoop::ShutdownThreadsAndCleanUp() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/browser_main_loop.cc:1027:5\n #11 0x10aad70a7 in content::BrowserMainRunnerImpl::Shutdown() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/browser_main_runner.cc:211:19\n #12 0x10be5663c in LayoutTestBrowserMain(content::MainFunctionParams const&, std::__1::unique_ptr > const&) /b/c/b/Mac_ASAN_Release_Media/src/content/shell/browser/layout_test/layout_test_browser_main.cc:149:16\n #13 0x10bdb32b7 in content::ShellMainDelegate::RunProcess(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&) /b/c/b/Mac_ASAN_Release_Media/src/content/shell/app/shell_main_delegate.cc:294:16\n #14 0x10a80434e in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) /b/c/b/Mac_ASAN_Release_Media/src/content/app/content_main_runner.cc:405:35\n #15 0x10a80702c in content::ContentMainRunnerImpl::Run() /b/c/b/Mac_ASAN_Release_Media/src/content/app/content_main_runner.cc:786:12\n #16 0x10a803613 in content::ContentMain(content::ContentMainParams const&) /b/c/b/Mac_ASAN_Release_Media/src/content/app/content_main.cc:20:28\n #17 0x106f922a4 in Content Shell Framework\n #18 0x106f86e03 in start\n\npreviously allocated by thread T0 here:\n #0 0x11fd2316c in __asan_memmove\n #1 0x10c97b96f in operator new(unsigned long) /b/c/b/Mac_ASAN_Release_Media/src/buildtools/third_party/libc++abi/trunk/src/cxa_new_delete.cpp:44:17\n #2 0x10ba878b7 in content::GpuProcessTransportFactory::GpuProcessTransportFactory() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/compositor/gpu_process_transport_factory.cc:181:39\n #3 0x10ba9896f in content::ImageTransportFactory::Initialize() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/compositor/image_transport_factory.cc:31:18\n #4 0x10aac600d in content::BrowserMainLoop::BrowserThreadsStarted() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/browser_main_loop.cc:1232:3\n #5 0x10b837f69 in Run /b/c/b/Mac_ASAN_Release_Media/src/base/callback.h:388:12\n #6 0x10b837f69 in content::StartupTaskRunner::RunAllTasksNow() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/startup_task_runner.cc:45\n #7 0x10aac3af7 in content::BrowserMainLoop::CreateStartupTasks() /b/c/b/Mac_ASAN_Release_Media/src/content/browser/browser_main_loop.cc:827:25\n #8 0x10aad6408 in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams const&) /b/c/b/Mac_ASAN_Release_Media/src/content/browser/browser_main_runner.cc:140:17\n #9 0x10be55df3 in LayoutTestBrowserMain(content::MainFunctionParams const&, std::__1::unique_ptr > const&) /b/c/b/Mac_ASAN_Release_Media/src/content/shell/browser/layout_test/layout_test_browser_main.cc:128:32\n #10 0x10bdb32b7 in content::ShellMainDelegate::RunProcess(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&) /b/c/b/Mac_ASAN_Release_Media/src/content/shell/app/shell_main_delegate.cc:294:16\n #11 0x10a80434e in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) /b/c/b/Mac_ASAN_Release_Media/src/content/app/content_main_runner.cc:405:35\n #12 0x10a80702c in content::ContentMainRunnerImpl::Run() /b/c/b/Mac_ASAN_Release_Media/src/content/app/content_main_runner.cc:786:12\n #13 0x10a803613 in content::ContentMain(content::ContentMainParams const&) /b/c/b/Mac_ASAN_Release_Media/src/content/app/content_main.cc:20:28\n #14 0x106f922a4 in Content Shell Framework\n #15 0x106f86e03 in start\n\nSUMMARY: AddressSanitizer: heap-use-after-free (/b/clusterfuzz/bot/builds/chrome-test-builds_media_mac-release_e6940505d6c387d688e04a7feeb7e2019c3efe81/revisions/asan-mac-release-415600/Content Shell.app/Contents/Frameworks/Content Shell Framework.framework/Content Shell Framework+0x9685e7d)\nShadow bytes around the buggy address:\n 0x1c240000e880: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd\n 0x1c240000e890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n 0x1c240000e8a0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa\n 0x1c240000e8b0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd\n 0x1c240000e8c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x1c240000e8d0: fd fd fd fd fd fd[fd]fd fd fd fa fa fa fa fa fa\n 0x1c240000e8e0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n 0x1c240000e8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x1c240000e900: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa\n 0x1c240000e910: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n 0x1c240000e920: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n==46471==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ignore_sanitizer.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_sanitizer.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/ignore_sanitizer.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_sanitizer.txt.snap index af09aeefae..12614c918e 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ignore_sanitizer.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_sanitizer.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ignore_sanitizer.txt +--- { "text": "=================================================================\n==4712==ERROR: AddressSanitizer: access-violation on unknown address 0x000000000010 (pc 0x7ff7cc4b2426 bp 0x00f6614fee60 sp 0x00f6614feb20 T4)\n==4712==The signal is caused by a READ memory access.\n==4712==Hint: address points to the zero page.\nSCARINESS: 10 (null-deref)\n==4712==*** WARNING: Failed to initialize DbgHelp! ***\n==4712==*** Most likely this means that the app is already ***\n==4712==*** using DbgHelp, possibly with incompatible flags. ***\n==4712==*** Due to technical reasons, symbolization might crash ***\n==4712==*** or produce wrong results. ***\n#EOF\n==4712==WARNING: Failed to use and restart external symbolizer!\n #0 0x7ff7cc4b2425 in _sanitizer_get_unmapped_bytes+0x1f1b8f5 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0xb802425)\n #1 0x7ff7cc4b6eeb in _sanitizer_get_unmapped_bytes+0x1f203bb (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0xb806eeb)\n #2 0x7ff7c6aa923b in _sanitizer_purge_allocator+0x317b2b (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x5df923b)\n #3 0x7ff7c6b5f7b5 in GetHandleVerifier+0x31e95 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x5eaf7b5)\n #4 0x7ff7c6b5dfe7 in GetHandleVerifier+0x306c7 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x5eadfe7)\n #5 0x7ff7c6b78da0 in GetHandleVerifier+0x4b480 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x5ec8da0)\n #6 0x7ff7c69a39bf in _sanitizer_purge_allocator+0x2122af (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x5cf39bf)\n #7 0x7ff7c6777718 in _asan_set_seh_filter+0xba8 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x5ac7718)\n #8 0x7ffe57838363 in BaseThreadInitThunk+0x13 (C:\\Windows\\System32\\KERNEL32.DLL+0x8363)\n #9 0x7ffe57cc7090 in RtlUserThreadStart+0x20 (C:\\Windows\\SYSTEM32\\ntdll.dll+0x67090)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: access-violation (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0xb802425) in _sanitizer_get_unmapped_bytes+0x1f1b8f5\nThread T4 created by T0 here:\n #0 0x7ff7c6776640 in _asan_wrap_CreateThread+0x90 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x5ac6640)\n #1 0x7ff7c69a2fcb in _sanitizer_purge_allocator+0x2118bb (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x5cf2fcb)\n #2 0x7ff7c6b77afa in GetHandleVerifier+0x4a1da (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x5ec7afa)\n #3 0x7ff7c6b77744 in GetHandleVerifier+0x49e24 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x5ec7744)\n #4 0x7ff7c6b6db23 in GetHandleVerifier+0x40203 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x5ebdb23)\n #5 0x7ff7c6b6cf8b in GetHandleVerifier+0x3f66b (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x5ebcf8b)\n #6 0x7ff7c6b44ff2 in GetHandleVerifier+0x176d2 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x5e94ff2)\n #7 0x7ff7ca3dc6f0 in IsSandboxedProcess+0x64fc80 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x972c6f0)\n #8 0x7ff7cda2f9d6 in _sanitizer_get_unmapped_bytes+0x3498ea6 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0xcd7f9d6)\n #9 0x7ff7cd7c7a64 in _sanitizer_get_unmapped_bytes+0x3230f34 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0xcb17a64)\n #10 0x7ff7cd7c852c in _sanitizer_get_unmapped_bytes+0x32319fc (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0xcb1852c)\n #11 0x7ff7cd6ded41 in _sanitizer_get_unmapped_bytes+0x3148211 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0xca2ed41)\n #12 0x7ff7c283d0e8 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x1b8d0e8)\n #13 0x7ff7c9eaae3c in IsSandboxedProcess+0x11e3cc (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x91fae3c)\n #14 0x7ff7c283bd76 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x1b8bd76)\n #15 0x7ff7c0cb11d4 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0x11d4)\n #16 0x7ff7d0c22728 in _lsan_unregister_root_region+0x487c18 (c:\\clusterfuzz\\bot\\builds\\chromium-browser-asan_win32-release_x64_e8abf88e7a5ec8bcd0cd391cfae402f143e8ddb2\\revisions\\asan-win32-release_x64-547370\\content_shell.exe+0xff72728)\n #17 0x7ffe57838363 in BaseThreadInitThunk+0x13 (C:\\Windows\\System32\\KERNEL32.DLL+0x8363)\n #18 0x7ffe57cc7090 in RtlUserThreadStart+0x20 (C:\\Windows\\SYSTEM32\\ntdll.dll+0x67090)\n\n==4712==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ignore_vdso.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_vdso.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/ignore_vdso.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_vdso.txt.snap index c2e3cd97c3..9a5489a7d4 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ignore_vdso.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_vdso.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ignore_vdso.txt +--- { "text": "[1:1:0308/122440.968711:FATAL:SimplifiedBackwardsTextIterator.cpp(243)] Check failed: static_cast(text_offset + text_length) <= text.length() (1056 vs. 1027)\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x00000001 (pc 0xf77b6be9 bp 0xffa51818 sp 0xffa516a8 T0)\nSCARINESS: 10 (signal)\n #0 0xf77b6be8 in [vdso]\n #1 0x626b2849 in logging::LogMessage::~LogMessage() ../../base/logging.cc:842:7\n #2 0x6e1571f0 in blink::SimplifiedBackwardsTextIteratorAlgorithm >::HandleTextNode() ../../third_party/WebKit/Source/core/editing/iterators/SimplifiedBackwardsTextIterator.cpp:243:3\n #3 0x6e154dcf in blink::SimplifiedBackwardsTextIteratorAlgorithm >::Advance() ../../third_party/WebKit/Source/core/editing/iterators/SimplifiedBackwardsTextIterator.cpp:155:27\n #4 0x6e154694 in blink::SimplifiedBackwardsTextIteratorAlgorithm >::Init(blink::Node const*, blink::Node const*, int, int) ../../third_party/WebKit/Source/core/editing/iterators/SimplifiedBackwardsTextIterator.cpp:130:3\n #5 0x6e154353 in blink::SimplifiedBackwardsTextIteratorAlgorithm >::SimplifiedBackwardsTextIteratorAlgorithm(blink::EphemeralRangeTemplate > const&, blink::TextIteratorBehavior const&) ../../third_party/WebKit/Source/core/editing/iterators/SimplifiedBackwardsTextIterator.cpp:89:3\n #6 0x6e144ad5 in blink::BackwardsCharacterIteratorAlgorithm >::BackwardsCharacterIteratorAlgorithm(blink::EphemeralRangeTemplate > const&, blink::TextIteratorBehavior const&) ../../third_party/WebKit/Source/core/editing/iterators/BackwardsCharacterIterator.cpp:42:7\n #7 0x6e24dad7 in CalculateHotModeCheckingRange ../../third_party/WebKit/Source/core/editing/spellcheck/HotModeSpellCheckRequester.cpp:82:30\n #8 0x6e24dad7 in blink::HotModeSpellCheckRequester::CheckSpellingAt(blink::PositionTemplate > const&) ../../third_party/WebKit/Source/core/editing/spellcheck/HotModeSpellCheckRequester.cpp:124\n #9 0x6e23d195 in blink::IdleSpellCheckCallback::HotModeInvocation(blink::IdleDeadline*) ../../third_party/WebKit/Source/core/editing/spellcheck/IdleSpellCheckCallback.cpp:147:13\n #10 0x6e23e2ce in blink::IdleSpellCheckCallback::invoke(blink::IdleDeadline*) ../../third_party/WebKit/Source/core/editing/spellcheck/IdleSpellCheckCallback.cpp:179:5\n #11 0x75d6d2e7 in blink::ScriptedIdleTaskController::RunCallback(int, double, blink::IdleDeadline::CallbackType) ../../third_party/WebKit/Source/core/dom/ScriptedIdleTaskController.cpp:234:14\n #12 0x75d6c9dc in blink::ScriptedIdleTaskController::CallbackFired(int, double, blink::IdleDeadline::CallbackType) ../../third_party/WebKit/Source/core/dom/ScriptedIdleTaskController.cpp:204:3\n #13 0x75d6b944 in blink::internal::IdleRequestCallbackWrapper::TimeoutFired(scoped_refptr) ../../third_party/WebKit/Source/core/dom/ScriptedIdleTaskController.cpp:59:19\n #14 0x75d72eb1 in Invoke > ../../base/bind_internal.h:402:12\n #15 0x75d72eb1 in MakeItSo), scoped_refptr > ../../base/bind_internal.h:530\n #16 0x75d72eb1 in RunImpl), std::__1::tuple >, 0> ../../base/bind_internal.h:604\n #17 0x75d72eb1 in base::internal::Invoker), scoped_refptr >, void ()>::RunOnce(base::internal::BindStateBase*) ../../base/bind_internal.h:572\n #18 0x62646a9f in Run ../../base/callback.h:95:12\n #19 0x62646a9f in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) ../../base/debug/task_annotator.cc:61\n #20 0x60f3203c in blink::scheduler::internal::ThreadControllerImpl::DoWork(blink::scheduler::internal::SequencedTaskSource::WorkType) ../../third_party/WebKit/Source/platform/scheduler/base/thread_controller_impl.cc:162:21\n #21 0x60f36e24 in Invoke &, const blink::scheduler::internal::SequencedTaskSource::WorkType &> ../../base/bind_internal.h:447:12\n #22 0x60f36e24 in MakeItSo &, const blink::scheduler::internal::SequencedTaskSource::WorkType &> ../../base/bind_internal.h:550\n #23 0x60f36e24 in RunImpl, blink::scheduler::internal::SequencedTaskSource::WorkType> &, 0, 1> ../../base/bind_internal.h:604\n #24 0x60f36e24 in base::internal::Invoker, blink::scheduler::internal::SequencedTaskSource::WorkType>, void ()>::Run(base::internal::BindStateBase*) ../../base/bind_internal.h:586\n #25 0x62646a9f in Run ../../base/callback.h:95:12\n #26 0x62646a9f in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) ../../base/debug/task_annotator.cc:61\n #27 0x62946a03 in base::internal::IncomingTaskQueue::RunTask(base::PendingTask*) ../../base/message_loop/incoming_task_queue.cc:124:19\n #28 0x626cf15e in base::MessageLoop::RunTask(base::PendingTask*) ../../base/message_loop/message_loop.cc:395:25\n #29 0x626d13c3 in DeferOrRunPendingTask ../../base/message_loop/message_loop.cc:407:5\n #30 0x626d13c3 in base::MessageLoop::DoWork() ../../base/message_loop/message_loop.cc:451\n #31 0x626d642b in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ../../base/message_loop/message_pump_default.cc:37:31\n #32 0x626cdc27 in Run ../../base/message_loop/message_loop.cc:346:12\n #33 0x626cdc27 in non-virtual thunk to base::MessageLoop::Run(bool) ../../base/message_loop/message_loop.cc:0\n #34 0x62791e4c in base::RunLoop::Run() ../../base/run_loop.cc:133:14\n #35 0x709e25c7 in content::RendererMain(content::MainFunctionParams const&) ../../content/renderer/renderer_main.cc:227:23\n #36 0x6163bafc in content::RunZygote(content::ContentMainDelegate*) ../../content/app/content_main_runner.cc:0:14\n #37 0x6163dae7 in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) ../../content/app/content_main_runner.cc:431:12\n #38 0x61640643 in content::ContentMainRunnerImpl::Run() ../../content/app/content_main_runner.cc:703:12\n #39 0x61636ca3 in content::ContentServiceManagerMainDelegate::RunEmbedderProcess() ../../content/app/content_service_manager_main_delegate.cc:51:32\n #40 0x61670564 in service_manager::Main(service_manager::MainParams const&) ../../services/service_manager/embedder/main.cc:453:29\n #41 0x6163b048 in content::ContentMain(content::ContentMainParams const&) ../../content/app/content_main.cc:19:10\n #42 0x5788aed7 in ChromeMain ../../chrome/app/chrome_main.cc:101:12\n #43 0x5788ac37 in main ../../chrome/app/chrome_exe_main_aura.cc:17:10\n #44 0xf5d21636 in __libc_start_main\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT ([vdso]+0xbe8)\n==1==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ignore_win_frames.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_win_frames.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/ignore_win_frames.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_win_frames.txt.snap index 2f5c78afdb..7b7014509e 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ignore_win_frames.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ignore_win_frames.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ignore_win_frames.txt +--- { "text": "==336==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x00201b12d49f at pc 0x7ff6bfabe9d9 bp 0x00201b12d2a0 sp 0x00201b12d2e8\nREAD of size 1 at 0x00201b12d49f thread T0\nSCARINESS: 27 (1-byte-read-stack-buffer-overflow)\n #0 0x7ff6bfabe9d8 in v8::internal::`anonymous namespace'::GenerateSourceString C:\\b\\s\\w\\ir\\cache\\builder\\src\\v8\\test\\fuzzer\\regexp-builtins.cc:294:25\n #1 0x7ff6bfaa3909 in LLVMFuzzerTestOneInput C:\\b\\s\\w\\ir\\cache\\builder\\src\\v8\\test\\fuzzer\\regexp-builtins.cc:442:3\n #2 0x7ff6bfae1203 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const *,unsigned __int64) C:\\b\\s\\w\\ir\\cache\\builder\\src\\third_party\\libFuzzer\\src\\FuzzerLoop.cpp:570\n #3 0x7ff6bfad77b5 in fuzzer::RunOneTest(class fuzzer::Fuzzer *,char const *,unsigned __int64) C:\\b\\s\\w\\ir\\cache\\builder\\src\\third_party\\libFuzzer\\src\\FuzzerDriver.cpp:280\n #4 0x7ff6bfadab6e in fuzzer::FuzzerDriver(int *,char * * *,int (*)(unsigned char const *,unsigned __int64)) C:\\b\\s\\w\\ir\\cache\\builder\\src\\third_party\\libFuzzer\\src\\FuzzerDriver.cpp:713\n #5 0x7ff6bfae71cc in main C:\\b\\s\\w\\ir\\cache\\builder\\src\\third_party\\libFuzzer\\src\\FuzzerMain.cpp:20\n #6 0x7ff6c2f1f0d3 in __scrt_common_main_seh f:\\dd\\vctools\\crt\\vcstartup\\src\\startup\\exe_common.inl:283\n #7 0x7ffef0608363 in BaseThreadInitThunk (C:\\Windows\\System32\\KERNEL32.DLL+0x180008363)\n #8 0x7ffef22d7090 in RtlUserThreadStart (C:\\Windows\\SYSTEM32\\ntdll.dll+0x180067090)\n\nAddress 0x00201b12d49f is located in stack of thread T0 at offset 383 in frame\n #0 0x7ff6bfabc36f in v8::internal::`anonymous namespace'::GenerateSourceString C:\\b\\s\\w\\ir\\cache\\builder\\src\\v8\\test\\fuzzer\\regexp-builtins.cc:290\n\n This frame has 8 object(s):\n [32, 64) 'ref.tmp.i58' (line 210)\n [96, 102) 'buffer.i' (line 252)\n [128, 160) 'ref.tmp.i' (line 194)\n [192, 224) 'pattern' (line 291)\n [256, 288) 'flags' (line 292)\n [320, 352) 'last_index' (line 293)\n [384, 416) 'subject' (line 294) <== Memory access at offset 383 underflows this variable\n [448, 696) 'ss' (line 297)\nHINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork\n (longjmp, SEH and C++ exceptions *are* supported)\nSUMMARY: AddressSanitizer: stack-buffer-overflow C:\\b\\s\\w\\ir\\cache\\builder\\src\\v8\\test\\fuzzer\\regexp-builtins.cc:294:25 in v8::internal::`anonymous namespace'::GenerateSourceString\nShadow bytes around the buggy address:\n 0x01a5ca825a40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x01a5ca825a50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x01a5ca825a60: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 f2 f2 f2 f2\n 0x01a5ca825a70: f8 f2 f2 f2 f8 f8 f8 f8 f2 f2 f2 f2 00 00 00 00\n 0x01a5ca825a80: f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00 00 00\n=>0x01a5ca825a90: f2 f2 f2[f2]00 00 00 00 f2 f2 f2 f2 f8 f8 f8 f8\n 0x01a5ca825aa0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n 0x01a5ca825ab0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f3 f3 f3 f3 f3\n 0x01a5ca825ac0: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00\n 0x01a5ca825ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x01a5ca825ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==336==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_deadly_signal.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_deadly_signal.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_deadly_signal.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_deadly_signal.txt.snap index ffdd3cfae3..80ef8d2765 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_deadly_signal.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_deadly_signal.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/libfuzzer_deadly_signal.txt +--- { "text": "==247664== ERROR: libFuzzer: deadly signal\n #0 0x4f2ae7 in __sanitizer_print_stack_trace /home/snd-local/releases/6.0/release/final/llvm.src/projects/compiler-rt/lib/asan/asan_stack.cc:38:3\n #1 0x42f0f6 in fuzzer::Fuzzer::CrashCallback() /home/snd-local/releases/6.0/release/final/llvm.src/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:233:5\n #2 0x42f0bf in fuzzer::Fuzzer::StaticCrashSignalCallback() /home/snd-local/releases/6.0/release/final/llvm.src/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:206:6\n #3 0x7fa27237a39f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1239f)\n #4 0x51a44a in LLVMFuzzerTestOneInput (/src/a.out+0x51a44a)\n #5 0x43061c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /home/snd-local/releases/6.0/release/final/llvm.src/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:515:13\n #6 0x42fe7b in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /home/snd-local/releases/6.0/release/final/llvm.src/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:440:3\n #7 0x43183d in fuzzer::Fuzzer::MutateAndTestOne() /home/snd-local/releases/6.0/release/final/llvm.src/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:648:19\n #8 0x432235 in fuzzer::Fuzzer::Loop(std::vector > const&) /home/snd-local/releases/6.0/release/final/llvm.src/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:775:5\n #9 0x4270b3 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /home/snd-local/releases/6.0/release/final/llvm.src/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:754:6\n #10 0x44a012 in main /home/snd-local/releases/6.0/release/final/llvm.src/projects/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10\n #11 0x7fa2719a852a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2352a)\n #12 0x41fda9 in _start (/src/a.out+0x41fda9)\n", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_fuzz_target_exited.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_fuzz_target_exited.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_fuzz_target_exited.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_fuzz_target_exited.txt.snap index 0a9c1b8ea1..f2734e2163 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_fuzz_target_exited.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_fuzz_target_exited.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/libfuzzer_fuzz_target_exited.txt +--- { "text": "==588579== ERROR: libFuzzer: fuzz target exited\n #0 0x4e8327 in __sanitizer_print_stack_trace third_party/llvm/llvm/projects/compiler-rt/lib/asan/asan_stack.cc:38:3\n #1 0x55209b in ExitCallback third_party/llvm/llvm/lib/Fuzzer/FuzzerLoop.cpp:211:5\n #2 0x55209b in fuzzer::Fuzzer::StaticExitCallback() third_party/llvm/llvm/lib/Fuzzer/FuzzerLoop.cpp:180\n #3 0x4f6a63 in LLVMFuzzerTestOneInput third_party/clearsilver/clearsilver_fuzzer_file.cc:4:16\n #4 0x553b8e in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/llvm/llvm/lib/Fuzzer/FuzzerLoop.cpp:494:13\n #5 0x55363e in fuzzer::Fuzzer::ShuffleAndMinimize(std::vector >, std::allocator > > >*) third_party/llvm/llvm/lib/Fuzzer/FuzzerLoop.cpp:389:3\n #6 0x54bbbe in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/llvm/llvm/lib/Fuzzer/FuzzerDriver.cpp:749:6\n #7 0x55d3a2 in main third_party/llvm/llvm/lib/Fuzzer/FuzzerMain.cpp:20:10\n\nSUMMARY: libFuzzer: fuzz target exited\nMS: 0 ; base unit: 0000000000000000000000000000000000000000", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_llvm_fuzzer_test_one_input_crash.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_llvm_fuzzer_test_one_input_crash.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_llvm_fuzzer_test_one_input_crash.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_llvm_fuzzer_test_one_input_crash.txt.snap index 43455caaa3..a02b80f6da 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_llvm_fuzzer_test_one_input_crash.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_llvm_fuzzer_test_one_input_crash.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/libfuzzer_llvm_fuzzer_test_one_input_crash.txt +--- { "text": "AddressSanitizer:DEADLYSIGNAL\n=================================================================\n==15227==ERROR: AddressSanitizer: ABRT on unknown address 0x03e900003b7b (pc 0x7f0ba613bc37 bp 0x7f0ba6288bf8 sp 0x7fff3c6cbfd8 T0)\nSCARINESS: 10 (signal)\n#0 0x7f0ba613bc36 in gsignal /build/eglibc-MjiXCM/eglibc-2.19/signal/../nptl/sysdeps/unix/sysv/linux/raise.c:56\n#1 0x7f0ba613f027 in abort /build/eglibc-MjiXCM/eglibc-2.19/stdlib/abort.c:89\n#2 0x7f0ba6134bf5 in __assert_fail_base /build/eglibc-MjiXCM/eglibc-2.19/assert/assert.c:92\n#3 0x7f0ba6134ca1 in __assert_fail /build/eglibc-MjiXCM/eglibc-2.19/assert/assert.c:101\n#4 0x3404db in LLVMFuzzerTestOneInput third_party/zlib/contrib/tests/fuzzers/deflate_set_dictionary_fuzzer.cc:35:5\n#5 0x3a8128 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:464:13\n#6 0x344c67 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:273:6\n#7 0x35a494 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:688:9\n#8 0x3fdc2e in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10\n#9 0x7f0ba6126f44 in __libc_start_main /build/eglibc-MjiXCM/eglibc-2.19/csu/libc-start.c:287\n#10 0x270028 in _start (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-debug-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-debug-515875/zlib_deflate_set_dictionary_fuzzer+0x270028)\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT /build/eglibc-MjiXCM/eglibc-2.19/signal/../nptl/sysdeps/unix/sysv/linux/raise.c:56 in gsignal\n==15227==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_oom.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_oom.txt.snap similarity index 97% rename from src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_oom.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_oom.txt.snap index 49135373cb..6fbe5dc287 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_oom.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_oom.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/libfuzzer_oom.txt +--- { "text": "/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_freetype2_b57c98057dc4c0067a21efc54058effece3bc33b/revisions/freetype2_fuzzer: Running 1 inputs 65536 time(s) each.\nRunning: /fuzz-2-freetype2_fuzzer\n#1\tpulse cov: 256 bits: 249 indir: 55 units: 0 exec/s: 0\n==1== ERROR: libFuzzer: out-of-memory (used: 3183Mb; limit: 3000Mb)\n To change the out-of-memory limit use -rss_limit_mb=\n\nLive Heap Allocations: 2379484 bytes from 64 allocations; showing top 50%\n2359368 byte(s) (99%) in 1 allocation(s)\n #0 0x4f8430 in operator new(unsigned long) /src/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:78\n #1 0x932ddf in fuzzer::Fuzzer::InitializeTraceState() /src/llvm/lib/Fuzzer/FuzzerTraceState.cpp:498:8\n #2 0x8be96f in fuzzer::Fuzzer::Fuzzer(int (*)(unsigned char const*, unsigned long), fuzzer::MutationDispatcher&, fuzzer::Fuzzer::FuzzingOptions) /src/llvm/lib/Fuzzer/FuzzerLoop.cpp:152:3\n #3 0x88eb73 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm/lib/Fuzzer/FuzzerDriver.cpp:351:10\n #4 0x915a48 in main /src/llvm/lib/Fuzzer/FuzzerMain.cpp:21:10\n #5 0x7f2c7742582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\n\nSUMMARY: libFuzzer: out-of-memory\n\n", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_oom_malloc.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_oom_malloc.txt.snap similarity index 97% rename from src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_oom_malloc.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_oom_malloc.txt.snap index a774897b6f..484f1f116b 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_oom_malloc.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_oom_malloc.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/libfuzzer_oom_malloc.txt +--- { "text": "/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_freetype2_b57c98057dc4c0067a21efc54058effece3bc33b/revisions/freetype2_fuzzer: Running 1 inputs 65536 time(s) each.\nRunning: /fuzz-2-freetype2_fuzzer\n#1\tpulse cov: 256 bits: 249 indir: 55 units: 0 exec/s: 0\n==31802== ERROR: libFuzzer: out-of-memory (malloc(4278190080))\n To change the out-of-memory limit use -rss_limit_mb=\n\nLive Heap Allocations: 2379484 bytes from 64 allocations; showing top 50%\n2359368 byte(s) (99%) in 1 allocation(s)\n #0 0x4f8430 in operator new(unsigned long) /src/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:78\n #1 0x932ddf in fuzzer::Fuzzer::InitializeTraceState() /src/llvm/lib/Fuzzer/FuzzerTraceState.cpp:498:8\n #2 0x8be96f in fuzzer::Fuzzer::Fuzzer(int (*)(unsigned char const*, unsigned long), fuzzer::MutationDispatcher&, fuzzer::Fuzzer::FuzzingOptions) /src/llvm/lib/Fuzzer/FuzzerLoop.cpp:152:3\n #3 0x88eb73 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm/lib/Fuzzer/FuzzerDriver.cpp:351:10\n #4 0x915a48 in main /src/llvm/lib/Fuzzer/FuzzerMain.cpp:21:10\n #5 0x7f2c7742582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\n\nSUMMARY: libFuzzer: out-of-memory\n\n", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_overwrites_const_input.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_overwrites_const_input.txt.snap similarity index 97% rename from src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_overwrites_const_input.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_overwrites_const_input.txt.snap index 7228478e6a..ca12cc1be1 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_overwrites_const_input.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_overwrites_const_input.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/libfuzzer_overwrites_const_input.txt +--- { "text": "==1== ERROR: libFuzzer: fuzz target overwrites its const input\n #0 0x52a761 in __sanitizer_print_stack_trace /src/llvm/projects/compiler-rt/lib/asan/asan_stack.cpp:86:3\n #1 0x4746f8 in fuzzer::PrintStackTrace() /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:205:5\n #2 0x45b483 in fuzzer::Fuzzer::CrashOnOverwrittenData() /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:518:3\n #3 0x45a49c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:564:5\n #4 0x444f91 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:292:6\n #5 0x44ac4e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:774:9\n #6 0x474dc2 in main /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10\n #7 0x7ff9d5db082f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/libc-start.c:291\n #8 0x41e348 in _start\nSUMMARY: libFuzzer: overwrites-const-input\n", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_timeout.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_timeout.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_timeout.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_timeout.txt.snap index 42ab7b7c7a..38657812bb 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/libfuzzer_timeout.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@libfuzzer_timeout.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/libfuzzer_timeout.txt +--- { "text": "ALARM: working on the last Unit for 5 seconds\n and the timeout value is 4 (use -timeout=N to change)\n==2855== ERROR: libFuzzer: timeout after 5 seconds\n #0 0x4c2c5e in __sanitizer_print_stack_trace (/mnt/ssd/chromium/src/out/Fuzzer/pdfium_fuzzer+0x4c2c5e)\n #1 0x53a6e2 in fuzzer::Fuzzer::AlarmCallback() out/Fuzzer/../../third_party/libFuzzer/src/FuzzerLoop.cpp:247:7\n #2 0x539966 in fuzzer::Fuzzer::StaticAlarmCallback() out/Fuzzer/../../third_party/libFuzzer/src/FuzzerLoop.cpp:195:6\n #3 0x5b9127 in fuzzer::AlarmHandler(int, siginfo*, void*) out/Fuzzer/../../third_party/libFuzzer/src/FuzzerUtil.cpp:76:3\n #4 0x7f614710832f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1032f)\n #5 0x39cb930 in CFX_ImageTransformer::Continue(IFX_Pause*) out/Fuzzer/../../third_party/pdfium/core/fxge/dib/fx_dib_transform.cpp:549:30\n #6 0x39c373c in CFX_DIBSource::TransformTo(CFX_Matrix const*, int&, int&, unsigned int, FX_RECT const*) const out/Fuzzer/../../third_party/pdfium/core/fxge/dib/fx_dib_transform.cpp:307:15\n #7 0x3497933 in CPDF_Type3Cache::RenderGlyph(CPDF_Type3Glyphs*, unsigned int, CFX_Matrix const*, float, float) out/Fuzzer/../../third_party/pdfium/core/fpdfapi/fpdf_render/fpdf_render_text.cpp:209:31\n #8 0x3495842 in CPDF_Type3Cache::LoadGlyph(unsigned int, CFX_Matrix const*, float, float) out/Fuzzer/../../third_party/pdfium/core/fpdfapi/fpdf_render/fpdf_render_text.cpp:79:7\n #9 0x349deda in CPDF_RenderStatus::ProcessType3Text(CPDF_TextObject const*, CFX_Matrix const*) out/Fuzzer/../../third_party/pdfium/core/fpdfapi/fpdf_render/fpdf_render_text.cpp:472:44\n #10 0x3499c5d in CPDF_RenderStatus::ProcessText(CPDF_TextObject const*, CFX_Matrix const*, CFX_PathData*) out/Fuzzer/../../third_party/pdfium/core/fpdfapi/fpdf_render/fpdf_render_text.cpp:234:12\n #11 0x33fbb69 in CPDF_RenderStatus::ProcessObjectNoClip(CPDF_PageObject const*, CFX_Matrix const*) out/Fuzzer/../../third_party/pdfium/core/fpdfapi/fpdf_render/fpdf_render.cpp:325:14\n #12 0x33fcf16 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject const*, CFX_Matrix const*, IFX_Pause*) out/Fuzzer/../../third_party/pdfium/core/fpdfapi/fpdf_render/fpdf_render.cpp:293:3\n #13 0x340c56a in CPDF_ProgressiveRenderer::Continue(IFX_Pause*) out/Fuzzer/../../third_party/pdfium/core/fpdfapi/fpdf_render/fpdf_render.cpp:1026:30\n #14 0x340a959 in CPDF_ProgressiveRenderer::Start(IFX_Pause*) out/Fuzzer/../../third_party/pdfium/core/fpdfapi/fpdf_render/fpdf_render.cpp:987:3\n #15 0x314b4b0 in FPDF_RenderPage_Retail(CRenderContext*, void*, int, int, int, int, int, int, int, IFSDK_PAUSE_Adapter*) out/Fuzzer/../../third_party/pdfium/fpdfsdk/fpdfview.cpp:884:26\n #16 0x3149ed8 in FPDF_RenderPageBitmap out/Fuzzer/../../third_party/pdfium/fpdfsdk/fpdfview.cpp:620:3\n #17 0x4e81eb in RenderPage(void* const&, void* const&, int) out/Fuzzer/../../pdf/pdfium/fuzzers/pdfium_fuzzer.cc:72:5\n #18 0x4e7bc9 in RenderPdf(char const*, unsigned long) out/Fuzzer/../../pdf/pdfium/fuzzers/pdfium_fuzzer.cc:164:5\n #19 0x4e6f8b in LLVMFuzzerTestOneInput out/Fuzzer/../../pdf/pdfium/fuzzers/pdfium_fuzzer.cc:220:3\n #20 0x547d14 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) out/Fuzzer/../../third_party/libFuzzer/src/FuzzerLoop.cpp:490:13\n #21 0x543b56 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) out/Fuzzer/../../third_party/libFuzzer/src/FuzzerLoop.cpp:446:3\n #22 0x50a823 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*) out/Fuzzer/../../third_party/libFuzzer/src/FuzzerDriver.cpp:257:6\n #23 0x50e5a8 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) out/Fuzzer/../../third_party/libFuzzer/src/FuzzerDriver.cpp:379:9\n #24 0x5897be in main out/Fuzzer/../../third_party/libFuzzer/src/FuzzerMain.cpp:21:10\n #25 0x7f6146b3ef44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287\n\nSUMMARY: libFuzzer: timeout\n", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/lkl_libfuzzer.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lkl_libfuzzer.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/lkl_libfuzzer.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@lkl_libfuzzer.txt.snap index 0ec05c91c5..139badfab6 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/lkl_libfuzzer.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lkl_libfuzzer.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/lkl_libfuzzer.txt +--- { "text": "xuanxing@xuanxing:~/Source/Android/_kernels/android12-5.4-lkl/out/android12-5.4-lkl/dist/fuzzers/hid_fuzzer$ ./hid-fuzzer crash-73129fcd9fe8746903460f4b9f9dfdcd208e0fcb \n[ 0.000000] Linux version 5.4.58+ (build-user@build-host) (Android (6794702, based on r399163) clang version 11.0.4 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d), GNU ld (GNU Binutils for Debian) 2.34) #1 2020-09-16 22:18:23\n[ 0.000000] memblock address range: 0x7f2a8885a000 - 0x7f2a8ba5a000\n[ 0.000000] KernelAddressSanitizer initialized\n...\n[ 0.044856] Run /init as init process\nINFO: Seed: 3953251032\nINFO: Loaded 1 modules (7670 inline 8-bit counters): 7670 [0xd825c8, 0xd843be), \nINFO: Loaded 1 PC tables (7670 PCs): 7670 [0xd843c0,0xda2320), \n./hid-fuzzer: Running 1 inputs 1 time(s) each.\nRunning: crash-73129fcd9fe8746903460f4b9f9dfdcd208e0fcb\nBegin xxx\nVID=0D05, PID=0109, RDESC: 45 bytes, INPUT: 0 byetes\nRDESC::size=45\n00000000: A1 01 85 03 95 01 2A FF 02 82 75 5B 10 15 FF 02 ......*...u[....\n00000010: 19 01 2A FF 02 81 00 C0 05 01 09 80 A1 01 85 81 ..*.............\n00000020: 29 7A B3 81 00 75 06 81 03 C0 06 BC C0 )z...u....... \n\nINPUT::size=0\n\n[ 0.058130] hid-generic 0003:0D05:0109.0001: unknown main item tag 0x1\n[ 0.058163] hid-generic 0003:0D05:0109.0001: unknown main item tag 0x0\n[ 0.058322] hid-generic 0003:0D05:0109.0001: unsupported Resolution Multiplier 0\n[ 0.058568] ==================================================================\n[ 0.058593] BUG: KASAN: slab-out-of-bounds in _etext+0x26eda/0x3121c4\n[ 0.058608] Write of size 4 at addr 00007f2a8ad06d18 by task kworker/0:1/11\n[ 0.058619] \n[ 0.058661] Linux Kernel Library Stack Trace:\n[ 0.058680] #0 [<0x000000000062a66a>] print_address_description+0x6a/0x5c0\n[ 0.058703] #1 [<0x000000000062ae14>] __kasan_report+0x134/0x190\n[ 0.058709] #2 [<0x000000000062a389>] kasan_report+0x9/0x10\n[ 0.058719] #3 [<0x000000000062b55f>] __asan_store4+0x6f/0x80\n[ 0.058730] #4 [<0x0000000000aa4266>] _etext+0x26eda/0x3121c4\n[ 0.058741] #5 [<0x0000000000a8f10c>] _etext+0x11d80/0x3121c4\n[ 0.058751] #6 [<0x0000000000a84530>] _etext+0x71a4/0x3121c4\n[ 0.058765] #7 [<0x0000000000a85048>] _etext+0x7cbc/0x3121c4\n[ 0.058779] #8 [<0x00000000008013f1>] hid_generic_probe+0xa1/0xd0\n[ 0.058789] #9 [<0x0000000000a85e08>] _etext+0x8a7c/0x3121c4\n[ 0.058802] #10 [<0x0000000000798e95>] really_probe+0x335/0x780\n[ 0.058815] #11 [<0x000000000079a146>] __device_attach_driver+0x196/0x220\n[ 0.058826] #12 [<0x0000000000795a2d>] bus_for_each_drv+0xfd/0x140\n[ 0.058839] #13 [<0x0000000000799489>] __device_attach+0x149/0x1c0\n[ 0.058853] #14 [<0x000000000079950e>] device_initial_probe+0xe/0x10\n[ 0.058865] #15 [<0x0000000000795ccc>] bus_probe_device+0x5c/0x100\n[ 0.058874] #16 [<0x00000000007905b5>] device_add+0xd25/0xfb0\n[ 0.058887] #17 [<0x0000000000a869a4>] _etext+0x9618/0x3121c4\n[ 0.058900] #18 [<0x0000000000aae488>] _etext+0x310fc/0x3121c4\n[ 0.058920] #19 [<0x000000000058e96c>] .str.31+0x1c/0x40\n[ 0.059002] #20 [<0x00000000005907d8>] .str.63+0x28/0x60\n[ 0.059027] #21 [<0x0000000000596aca>] .str.31+0x1a/0x30\n[ 0.059035] #22 [<0x000000000055eb0b>] .str+0x3b/0x40\n[ 0.059052] #23 [<0x00007f2a8c591ea7>] 0x7f2a8c591ea7\n[ 0.059061] \n[ 0.059068] \n[ 0.059077] \n[ 0.059085] Memory state around the buggy address:\n[ 0.059094] 00007f2a8ad06c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 0.059106] 00007f2a8ad06c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 0.059115] >00007f2a8ad06d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 0.059125] ^\n[ 0.059133] 00007f2a8ad06d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 0.059142] 00007f2a8ad06e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 0.059152] ==================================================================\n[ 0.059166] Disabling lock debugging due to kernel taint\n[ 0.059175] Kernel panic - not syncing: panic_on_warn set ...\n[ 0.059187] ---[ end Kernel panic - not syncing: panic_on_warn set ... ]---\nhid-fuzzer: lib/posix-host.c:401: void panic(void): Assertion `0' failed.\n==872614== ERROR: libFuzzer: deadly signal\n #0 0x554630 (/usr/local/google/home/xuanxing/Source/Android/_kernels/android12-5.4-lkl/out/android12-5.4-lkl/dist/fuzzers/hid_fuzzer/hid-fuzzer+0x554630)\n #1 0x4fffc8 (/usr/local/google/home/xuanxing/Source/Android/_kernels/android12-5.4-lkl/out/android12-5.4-lkl/dist/fuzzers/hid_fuzzer/hid-fuzzer+0x4fffc8)\n #2 0x4e53b3 (/usr/local/google/home/xuanxing/Source/Android/_kernels/android12-5.4-lkl/out/android12-5.4-lkl/dist/fuzzers/hid_fuzzer/hid-fuzzer+0x4e53b3)\n #3 0x7f2a8c59d13f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1413f)\n #4 0x7f2a8c299db0 (/lib/x86_64-linux-gnu/libc.so.6+0x3bdb0)\n #5 0x7f2a8c283536 (/lib/x86_64-linux-gnu/libc.so.6+0x25536)\n #6 0x7f2a8c28340e (/lib/x86_64-linux-gnu/libc.so.6+0x2540e)\n #7 0x7f2a8c2925b1 (/lib/x86_64-linux-gnu/libc.so.6+0x345b1)\n #8 0x557fff (/usr/local/google/home/xuanxing/Source/Android/_kernels/android12-5.4-lkl/out/android12-5.4-lkl/dist/fuzzers/hid_fuzzer/hid-fuzzer+0x557fff)\n #9 0x55e560 (/usr/local/google/home/xuanxing/Source/Android/_kernels/android12-5.4-lkl/out/android12-5.4-lkl/dist/fuzzers/hid_fuzzer/hid-fuzzer+0x55e560)\n\nNOTE: libFuzzer has rudimentary signal handlers.\n Combine libFuzzer with AddressSanitizer or similar for better crash reports.\nSUMMARY: libFuzzer: deadly signal\n", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/lkl_libfuzzer_symbolized.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lkl_libfuzzer_symbolized.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/lkl_libfuzzer_symbolized.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@lkl_libfuzzer_symbolized.txt.snap index 398fb0db7e..48515fcc7c 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/lkl_libfuzzer_symbolized.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lkl_libfuzzer_symbolized.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/lkl_libfuzzer_symbolized.txt +--- { "text": "disk/temp-1028899/mutations /usr/local/google/home/mspector/DEBUG/localhost-46191/clusterfuzz/bot/inputs/fuzzer-testcases-disk/temp-1028899/subset\nBot: android-mspector-linuxworkstation.kir.corp.google.com-localhost:46191\nTime ran: 453.0651717185974\n\n[ 0.000000] Linux version 5.4.58+-ab6926695 (build-user@build-host) (Android (6794702, based on r399163) clang version 11.0.4 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d), GNU ld (GNU Binutils for Ubuntu) 2.24) #1 2020-10-16 23:03:14\n[ 0.000000] memblock address range: 0x7f697c86b000 - 0x7f697fa6b000\n[ 0.000000] KernelAddressSanitizer initialized\n[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 12625\n[ 0.000000] Kernel command line: mem=50M\n[ 0.000000] Dentry cache hash table entries: 8192 (order: 4, 65536 bytes, linear)\n[ 0.000000] Inode-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)\n[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off\n[ 0.000000] Memory available: 50336k/51200k RAM\n[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1\n[ 0.000000] NR_IRQS: 4096\n[ 0.000000] lkl: irqs initialized\n[ 0.000000] clocksource: lkl: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns\n[ 0.000003] lkl: time and timers initialized (irq1)\nDone.\nBegin xxx\nVID=0104, PID=00C5, RDESC: 114 bytes, INPUT: 0 byetes\nRDESC::size=114\n00000000: 28 28 28 28 B1 28 28 28 28 28 28 B5 28 28 28 28 ((((.((((((.((((\n00000010: 28 28 28 28 28 28 28 28 28 28 28 01 2A 64 02 28 (((((((((((.*d.(\n00000020: 28 28 28 28 28 28 28 28 28 28 28 28 A8 28 28 28 ((((((((((((.(((\n00000030: 28 28 28 28 28 28 28 28 28 28 28 28 28 28 00 00 ((((((((((((((..\n00000040: 00 00 09 00 00 38 00 80 C0 01 09 00 09 02 00 75 .....8.........u\n00000050: 0A 31 02 81 00 5D C0 21 05 0C 09 47 81 06 95 81 .1...].!...G....\n00000060: 06 81 06 30 C0 05 28 0C 09 01 A1 01 D9 04 00 00 ...0..(.........\n00000070: 00 C0 ..\n\nINPUT::size=0\n\nDone.\nBegin xxx\nVID=3600, PID=8042, RDESC: 125 bytes, INPUT: 0 byetes\nRDESC::size=125\n00000000: 06 C0 C0 05 0C 09 [ 126.008447] hid-generic 0003:3600:8042.81F8: unknown main item tag 0x0\n[ 126.008497] hid-generic 0003:3600:8042.81F8: unknown main item tag 0x0\n[ 126.008521] hid-generic 0003:3600:8042.81F8: unknown main item tag 0x0\n[ 126.008536] hid-generic 0003:3600:8042.81F8: unknown main item tag 0x0\n[ 126.008551] hid-generic 0003:3600:8042.81F8: unknown main item tag 0x4\n[ 126.008568] hid-generic 0003:3600:8042.81F8: ignoring exceeding usage max\n[ 126.010925] hid-generic 0003:3600:8042.81F8: unknown main item tag 0x0\n[ 126.010953] hid-generic 0003:3600:8042.81F8: unknown main item tag 0x1\n[ 126.010970] hid-generic 0003:3600:8042.81F8: unknown main item tag 0x0\n[ 126.011047] hid-generic 0003:3600:8042.81F8: unknown main item tag 0x0\n[ 126.011081] hid-generic 0003:3600:8042.81F8: unknown main item tag 0x0\n[ 126.011108] hid-generic 0003:3600:8042.81F8: unknown main item tag 0x0\n[ 126.011125] hid-generic 0003:3600:8042.81F8: unknown main item tag 0x0\n[ 126.013085] ==================================================================\n[ 126.013117] BUG: KASAN: slab-out-of-bounds in _etext+0x26eda/0x312104\n[ 126.013128] Write of size 4 at addr 00007f5256480ddc by task kworker/0:1/11\n[ 126.013133]\n[ 126.013141] Linux Kernel Library Stack Trace:\n #0 0x00000000005e6dda in print_address_description /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/mm/kasan/report.c:375:2\n #1 0x00000000005e7584 in __kasan_report /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/mm/kasan/report.c:507:3\n #2 0x00000000005e6af9 in kasan_report /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/mm/kasan/common.c:636:1\n #3 0x00000000005e7ccf in __asan_store4 /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/mm/kasan/generic.c:250:1\n #4 0x0000000000a60a36 in __hidinput_change_resolution_multipliers /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/hid/hid-input.c:0:31\n #5 0x0000000000a4b8dc in hidinput_connect /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/hid/hid-input.c:1615:7\n #6 0x0000000000a40d00 in hid_connect /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/hid/hid-core.c:1931:48\n #7 0x0000000000a41818 in hid_hw_start /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/hid/hid-core.c:2035:11\n #8 0x00000000007bdb81 in hid_generic_probe /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/hid/hid-generic.c:67:9\n #9 0x0000000000a425d8 in hid_device_probe /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/hid/hid-core.c:2263:10\n #10 0x0000000000755615 in really_probe /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/base/dd.c:566:13\n #11 0x00000000007568c6 in __device_attach_driver /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/base/dd.c:745:9\n #12 0x00000000007521ad in bus_for_each_drv /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/base/bus.c:430:11\n #13 0x0000000000755c09 in __device_attach /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/base/dd.c:918:9\n #14 0x0000000000755c8e in device_initial_probe /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/base/dd.c:966:1\n #15 0x000000000075244c in bus_probe_device /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/base/bus.c:492:19\n #16 0x000000000074cd35 in device_add /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/base/core.c:2820:6\n #17 0x0000000000a43174 in hid_add_device /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/hid/hid-core.c:2419:8\n #18 0x0000000000a6ac58 in uhid_device_add_worker /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/drivers/hid/uhid.c:62:8\n[ 126.013377] #19 [<0x000000000054b0cc>] .str.8+0x2c/0x60\n #19 0x000000000054cf38 in worker_thread /buildbot/src/partner-android/android12-5.4-lkl/private/lkl/kernel/workqueue.c:2420:4\n[ 126.013399] #21 [<0x000000000055322a>] .str.24+0x2a/0x40\n[ 126.013418] #22 [<0x000000000051b21b>] .str.2+0x3b/0x50\n[ 126.013428] #23 [<0x000000000051505a>] 0x51505a\n[ 126.013434]\n[ 126.013440]\n[ 126.013446]\n[ 126.013452] Memory state around the buggy address:\n[ 126.013462] 00007f5256480c80: 00 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc\n[ 126.013471] 00007f5256480d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 126.013480] >00007f5256480d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 126.013487] ^\n[ 126.013496] 00007f5256480e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 126.013505] 00007f5256480e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 126.013511] ==================================================================\n[ 126.013521] Disabling lock debugging due to kernel taint\n[ 126.013533] Kernel panic - not syncing: panic_on_warn set ...\n[ 126.013545] ---[ end Kernel panic - not syncing: panic_on_warn set ... ]---\nhid-fuzzer: lib/posix-host.c:191: void panic(void): Assertion `0' failed.\n==2434886== ERROR: libFuzzer: deadly signal\n #0 0x510c60 (/usr/local/google/home/mspector/DEBUG/localhost-46191/clusterfuzz/bot/builds/android-haiku_host-lkl-userdebug_hid-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/hid-fuzzer+0x510c60)\n #1 0x4bc5f8 (/usr/local/google/home/mspector/DEBUG/localhost-46191/clusterfuzz/bot/builds/android-haiku_host-lkl-userdebug_hid-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/hid-fuzzer+0x4bc5f8)\n #2 0x4a19e3 (/usr/local/google/home/mspector/DEBUG/localhost-46191/clusterfuzz/bot/builds/android-haiku_host-lkl-userdebug_hid-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/hid-fuzzer+0x4a19e3)\n #3 0x7f525812113f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1413f)\n #4 0x7f5257e1ddb0 (/lib/x86_64-linux-gnu/libc.so.6+0x3bdb0)\n #5 0x7f5257e07536 (/lib/x86_64-linux-gnu/libc.so.6+0x25536)\n #6 0x7f5257e0740e (/lib/x86_64-linux-gnu/libc.so.6+0x2540e)\n #7 0x7f5257e165b1 (/lib/x86_64-linux-gnu/libc.so.6+0x345b1)\n #8 0x5147ff (/usr/local/google/home/mspector/DEBUG/localhost-46191/clusterfuzz/bot/builds/android-haiku_host-lkl-userdebug_hid-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/hid-fuzzer+0x5147ff)\n #9 0x51ac70 (/usr/local/google/home/mspector/DEBUG/localhost-46191/clusterfuzz/bot/builds/android-haiku_host-lkl-userdebug_hid-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/hid-fuzzer+0x51ac70)\n\nNOTE: libFuzzer has rudimentary signal handlers.\n Combine libFuzzer with AddressSanitizer or similar for better crash reports.\nSUMMARY: libFuzzer: deadly signal\nMS: 1 ChangeBit-; base unit: 0f4f6db1f0a8dbaced22d98bef470b9fa32740b1\n0x94,0xa,0x0,0x6d,0x0,0x36,0x42,0x80,0x6,0xc0,0xc0,0x5,0xc,0x9,0x1,0xa1,0x1,0x85,0x81,0x3,0xac,0x6,0xbc,0x4e,0x4e,0x1,0x0,0x0,0x0,0x0,0x41,0x2d,0x4a,0x0,0x95,0x95,0x1,0x2a,0x1,0xf6,0xce,0x7f,0x5e,0xb1,0xb1,0xb1,0xb1,0x2a,0xff,0x2,0x81,0x0,0xc0,0x9,0x32,0x5,0x1,0x80,0xa1,0x1,0xa5,0x1,0xa1,0x4e,0x4e,0xe,0x4e,0x2a,0xff,0x2,0x81,0x0,0xc0,0x5,0x1,0x9,0x34,0x80,0xa1,0x1,0x1,0x0,0x13,0xec,0xf9,0x8,0x82,0x2,0x4f,0x4f,0x4f,0x4f,0x4f,0x4f,0x89,0x9,0x83,0x2a,0x81,0x0,0xb1,0x0,0x81,0x3,0xc0,0x6,0xbc,0x4e,0x4e,0x4e,0x2a,0x2,0x81,0x0,0xc0,0x5,0x27,0x1,0x9,0x34,0x80,0x3,0xc7,0x6,0xbc,0x4e,0x4e,0x4a,0x80,0x4e,0x4e,0x4e,0x0,\n\\x94\\x0a\\x00m\\x006B\\x80\\x06\\xc0\\xc0\\x05\\x0c\\x09\\x01\\xa1\\x01\\x85\\x81\\x03\\xac\\x06\\xbcNN\\x01\\x00\\x00\\x00\\x00A-J\\x00\\x95\\x95\\x01*\\x01\\xf6\\xce\\x7f^\\xb1\\xb1\\xb1\\xb1*\\xff\\x02\\x81\\x00\\xc0\\x092\\x05\\x01\\x80\\xa1\\x01\\xa5\\x01\\xa1NN\\x0eN*\\xff\\x02\\x81\\x00\\xc0\\x05\\x01\\x094\\x80\\xa1\\x01\\x01\\x00\\x13\\xec\\xf9\\x08\\x82\\x02OOOOOO\\x89\\x09\\x83*\\x81\\x00\\xb1\\x00\\x81\\x03\\xc0\\x06\\xbcNNN*\\x02\\x81\\x00\\xc0\\x05'\\x01\\x094\\x80\\x03\\xc7\\x06\\xbcNNJ\\x80NNN\\x00\nartifact_prefix='/usr/local/google/home/mspector/DEBUG/localhost-46191/clusterfuzz/bot/inputs/fuzzer-testcases/'; Test unit written to /usr/local/google/home/mspector/DEBUG/localhost-46191/clusterfuzz/bot/inputs/fuzzer-testcases/crash-ba41547c2c098e2e6688b9e4330de3ab3a6891e1\nBase64: lAoAbQA2QoAGwMAFDAkBoQGFgQOsBrxOTgEAAAAAQS1KAJWVASoB9s5/XrGxsbEq/wKBAMAJMgUBgKEBpQGhTk4OTir/AoEAwAUBCTSAoQEBABPs+QiCAk9PT09PT4kJgyqBALEAgQPABrxOTk4qAoEAwAUnAQk0gAPHBrxOTkqATk5OAA==", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/lkl_libfuzzer_unsymbolized.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lkl_libfuzzer_unsymbolized.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/lkl_libfuzzer_unsymbolized.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@lkl_libfuzzer_unsymbolized.txt.snap index 4b629477fc..28ab99eaeb 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/lkl_libfuzzer_unsymbolized.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lkl_libfuzzer_unsymbolized.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/lkl_libfuzzer_unsymbolized.txt +--- { "text": "[Environment] ASAN_OPTIONS=\"exitcode=77\"\n[Environment] UBSAN_OPTIONS=\"handle_abort=1\"\n+----------------------------------------Release Build Stacktrace----------------------------------------+\nCommand: /mnt/scratch0/clusterfuzz/bot/builds/android-haiku_host-lkl-userdebug_hid-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/hid-fuzzer -rss_limit_mb=2560 -timeout=90 -runs=100 /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-bc8061c819522a21e84cce1268b8ca6b3636ae6b\nBot: clusterfuzz-linux-h8r2\nTime ran: 0.8239428997039795\n[ 0.000000] Linux version 5.4.58+-ab6966248 (build-user@build-host) (Android (6794702, based on r399163) clang version 11.0.4 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d), GNU ld (GNU Binutils for Ubuntu) 2.24) #1 Thu Oct 29 03:05:33 UTC 2020\n[ 0.000000] memblock address range: 0x7f58ace00000 - 0x7f58b0000000\n[ 0.000000] KernelAddressSanitizer initialized\n[ 0.000000] Built 1 zonelists, mobility grouping on. Total http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8/pages#12625;lkl/pages;\n[ 0.000000] Kernel command line: mem=50M\n[ 0.000000] Dentry cache hash table entries: 8192 (order: 4, 65536 bytes, linear)\n[ 0.000000] Inode-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)\n[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off\n[ 0.000000] Memory available: 50336k/51200k RAM\n[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1\n[ 0.000000] http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8/NR_IRQS#4096;lkl/NR_IRQS;\n[ 0.000000] lkl: irqs initialized\n[ 0.000000] clocksource: lkl: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns\n[ 0.000002] lkl: time and timers initialized (irq1)\n[ 0.000025] pid_max: default: 4096 http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8/minimum#301;lkl/minimum;\n[ 0.000101] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)\n[ 0.000108] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)\n[ 0.017075] random: get_random_bytes called from _etext+0x726b6/0x31286a with crng_init=0\n[ 0.017250] printk: console [lkl_console0] enabled\n[ 0.017303] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns\n[ 0.017465] NET: Registered protocol family 16\n[ 0.017695] lkl_pci: probe of lkl_pci failed with error -1\n[ 0.020112] vgaarb: loaded\n[ 0.020486] clocksource: Switched to clocksource lkl\n[ 0.020864] NET: Registered protocol family 2\n[ 0.021176] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)\n[ 0.021196] TCP established hash table entries: 512 (order: 0, 4096 bytes, linear)\n[ 0.021210] TCP bind hash table entries: 512 (order: 0, 4096 bytes, linear)\n[ 0.021225] TCP: Hash tables configured (established 512 bind 512)\n[ 0.021298] UDP hash table entries: 128 (order: 0, 4096 bytes, linear)\n[ 0.021311] UDP-Lite hash table entries: 128 (order: 0, 4096 bytes, linear)\n[ 0.021371] PCI: CLS 0 bytes, default 32\n[ 0.023240] workingset: timestamp_bits=62 max_order=15 bucket_order=0\n[ 0.027233] io scheduler mq-deadline registered\n[ 0.027253] io scheduler kyber registered\n[ 0.038634] hidraw: raw HID events driver (C) Jiri Kosina\n[ 0.040318] NET: Registered protocol family 10\n[ 0.041599] Segment Routing with IPv6\n[ 0.041650] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver\n[ 0.042070] Warning: unable to open an initial console.\n[ 0.042109] This architecture does not have kernel memory protection.\n[ 0.042115] Run /init as init process\nINFO: http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8/Seed#3181469268;lkl/Seed;\nINFO: Loaded 1 modules (7670 inline 8-bit counters): 7670 [0xdbadf8, 0xdbcbee),\nINFO: Loaded 1 PC tables (7670 PCs): 7670 [0xdbcbf0,0xddab50),\n/mnt/scratch0/clusterfuzz/bot/builds/android-haiku_host-lkl-userdebug_hid-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/hid-fuzzer: Running 1 inputs 100 time(s) each.\nRunning: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-bc8061c819522a21e84cce1268b8ca6b3636ae6b\n[ 0.064445] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.064480] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.064492] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.064519] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.064531] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.064542] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.064554] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.064565] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.064577] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.064589] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.064612] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.064706] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.064718] hid-generic 0003:0405:C52B.0001: ignoring exceeding usage max\n[ 0.065552] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.065589] hid-generic 0003:0405:C52B.0001: ignoring exceeding usage max\n[ 0.070895] ==================================================================\n[ 0.070933] BUG: KASAN: slab-out-of-bounds in _etext+0x26f10/0x31286a\n[ 0.070941] Write of size 4 at addr 00007f58af2ac9ec by task kworker/0:1/11\n[ 0.070945]\n[ 0.070949] Linux Kernel Library Stack Trace:\n[ 0.070964] #0 [<0x000000000063b2ea>] print_address_description+0x6a/0x5c0\n[ 0.070972] #1 [<0x000000000063ba94>] __kasan_report+0x134/0x190\n[ 0.070978] #2 [<0x000000000063afe9>] kasan_report+0x9/0x10\n[ 0.070985] #3 [<0x000000000063c1df>] __asan_store4+0x6f/0x80\n[ 0.070992] #4 [<0x0000000000ab4a86>] _etext+0x26f10/0x31286a\n[ 0.071003] #5 [<0x0000000000a9f92c>] _etext+0x11db6/0x31286a\n[ 0.071010] #6 [<0x0000000000a94d30>] _etext+0x71ba/0x31286a\n[ 0.071016] #7 [<0x0000000000a95848>] _etext+0x7cd2/0x31286a\n[ 0.071027] #8 [<0x0000000000811511>] hid_generic_probe+0xa1/0xd0\n[ 0.071034] #9 [<0x0000000000a96608>] _etext+0x8a92/0x31286a\n[ 0.071042] #10 [<0x00000000007a8e35>] really_probe+0x335/0x780\n[ 0.071050] #11 [<0x00000000007aa0e6>] __device_attach_driver+0x196/0x220\n[ 0.071056] #12 [<0x00000000007a59bd>] bus_for_each_drv+0xfd/0x140\n[ 0.071063] #13 [<0x00000000007a9429>] .L___asan_gen_.2+0x38/0xaf\n[ 0.071070] #14 [<0x00000000007a94ae>] device_initial_probe+0xe/0x10\n[ 0.071077] #15 [<0x00000000007a5c5c>] bus_probe_device+0x5c/0x100\n[ 0.071083] #16 [<0x00000000007a073f>] device_add+0xb5f/0xcb0\n[ 0.071090] #17 [<0x0000000000a971ae>] _etext+0x9638/0x31286a\n[ 0.071096] #18 [<0x0000000000abecc8>] _etext+0x31152/0x31286a\n[ 0.071107] #19 [<0x000000000059fcdc>] .str.15+0x1c/0x40\n[ 0.071113] #20 [<0x00000000005a11d8>] .str.54+0x18/0x40\n[ 0.071121] #21 [<0x00000000005a74ca>] .str.2+0x2a/0x40\n[ 0.071129] #22 [<0x000000000056f9ab>] .str.3+0x4b/0x60\n[ 0.071134] #23 [<0x00000000005697d5>] 0x5697d5\n[ 0.071138]\n[ 0.071142]\n[ 0.071146]\n[ 0.071150] Memory state around the buggy address:\n[ 0.071163] 00007f58af2ac880: 00 00 00 00 00 00 00 00 00 00 04 fe fe fe fe fe\n[ 0.071169] 00007f58af2ac900: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe\n[ 0.071174] >00007f58af2ac980: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe\n[ 0.071179] ^\n[ 0.071184] 00007f58af2aca00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe\n[ 0.071190] 00007f58af2aca80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe\n[ 0.071194] ==================================================================\n[ 0.071199] Disabling lock debugging due to kernel taint\n[ 0.071205] Kernel panic - not syncing: panic_on_warn set ...\n[ 0.071211] ---[ end Kernel panic - not syncing: panic_on_warn set ... ]---\nhid-fuzzer: lib/posix-host.c:191: void panic(void): Assertion `0' failed.\nBegin xxx\nVID=0405, PID=C52B, RDESC: 75 bytes, INPUT: 0 byetes\nRDESC::size=75\n00000000: 05 01 09 02 24 00 00 00 09 01 A1 00 81 06 7E BA ....$.........~.\n00000010: BA BA BA BA BA BA B0 95 01 00 00 00 00 00 00 00 ................\n00000020: 85 BA 02 BA BA 36 15 01 BA BA BA B0 19 01 2A 04 .....6........*.\n00000030: 03 B0 95 85 02 15 01 2A 26 FF 02 19 01 2A FF B0 .......*&....*..\n00000040: 46 02 5C 05 08 06 80 FF 81 00 C0 F.\\........\nINPUT::size=0\nUndefinedBehaviorSanitizer:DEADLYSIGNAL\n==2169144==ERROR: UndefinedBehaviorSanitizer: ABRT on unknown address 0x053900211938 (pc 0x7f58b7464438 bp 0x00000020f635 sp 0x7f58957f9128 T2169166)\n #0 0x7f58b7464438 in gsignal http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8//build/glibc-e6zv40/glibc-2.23/sysdeps/unix/sysv/linux/raise.c#54;lkl//build/glibc-e6zv40/glibc-2.23/sysdeps/unix/sysv/linux/raise.c;\n #1 0x7f58b7466039 in abort http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8//build/glibc-e6zv40/glibc-2.23/stdlib/abort.c#89;lkl//build/glibc-e6zv40/glibc-2.23/stdlib/abort.c;\n #2 0x7f58b745cbe6 in __assert_fail_base http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8//build/glibc-e6zv40/glibc-2.23/assert/assert.c#92;lkl//build/glibc-e6zv40/glibc-2.23/assert/assert.c;\n #3 0x7f58b745cc91 in __assert_fail http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8//build/glibc-e6zv40/glibc-2.23/assert/assert.c#101;lkl//build/glibc-e6zv40/glibc-2.23/assert/assert.c;\n #4 0x568f3f in panic http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8/tools/lkl/lib/posix-host.c#191;lkl/tools/lkl/lib/posix-host.c;:2\n #5 0x56f3f0 in lkl_panic_blink http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8/arch/lkl/kernel/setup.c#27;lkl/arch/lkl/kernel/setup.c;:2\nUndefinedBehaviorSanitizer can not provide additional info.\nSUMMARY: UndefinedBehaviorSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x35438)\n==2169144==ABORTING\n+----------------------------------------Release Build Unsymbolized Stacktrace (diff)----------------------------------------+\nUndefinedBehaviorSanitizer:DEADLYSIGNAL\n==2169144==ERROR: UndefinedBehaviorSanitizer: ABRT on unknown address 0x053900211938 (pc 0x7f58b7464438 bp 0x00000020f635 sp 0x7f58957f9128 T2169166)\n #0 0x7f58b7464438 (/lib/x86_64-linux-gnu/libc.so.6+0x35438)\n #1 0x7f58b7466039 (/lib/x86_64-linux-gnu/libc.so.6+0x37039)\n #2 0x7f58b745cbe6 (/lib/x86_64-linux-gnu/libc.so.6+0x2dbe6)\n #3 0x7f58b745cc91 (/lib/x86_64-linux-gnu/libc.so.6+0x2dc91)\n #4 0x568f3f (/mnt/scratch0/clusterfuzz/bot/builds/android-haiku_host-lkl-userdebug_hid-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/hid-fuzzer+0x568f3f)\n #5 0x56f3f0 (/mnt/scratch0/clusterfuzz/bot/builds/android-haiku_host-lkl-userdebug_hid-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/hid-fuzzer+0x56f3f0)\nORIGINAL STACKTRACE ON REVISION 6963696 (148 LINES)\n[Environment] ASAN_OPTIONS=\"dedup_token_length=3:exitcode=77:symbolize=1\"\n[Environment] UBSAN_OPTIONS=\"handle_abort=1\"\n+----------------------------------------Release Build Stacktrace----------------------------------------+\nCommand: /mnt/scratch0/clusterfuzz/bot/builds/android-haiku_host-lkl-userdebug_hid-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/hid-fuzzer -rss_limit_mb=2560 -timeout=90 -runs=100 /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-bc8061c819522a21e84cce1268b8ca6b3636ae6b\nBot: clusterfuzz-linux-k1gh\nTime ran: 0.12106442451477051\n[ 0.000000] Linux version 5.4.58+-ab6963696 (build-user@build-host) (Android (6794702, based on r399163) clang version 11.0.4 (https://android.googlesource.com/toolchain/llvm-project 87f1315dfbea7c137aa2e6d362dbb457e388158d), GNU ld (GNU Binutils for Ubuntu) 2.24) #1 Thu Oct 29 03:05:33 UTC 2020\n[ 0.000000] memblock address range: 0x7f9d04e00000 - 0x7f9d08000000\n[ 0.000000] KernelAddressSanitizer initialized\n[ 0.000000] Built 1 zonelists, mobility grouping on. Total http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8/pages#12625;lkl/pages;\n[ 0.000000] Kernel command line: mem=50M\n[ 0.000000] Dentry cache hash table entries: 8192 (order: 4, 65536 bytes, linear)\n[ 0.000000] Inode-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)\n[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off\n[ 0.000000] Memory available: 50336k/51200k RAM\n[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1\n[ 0.000000] http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8/NR_IRQS#4096;lkl/NR_IRQS;\n[ 0.000000] lkl: irqs initialized\n[ 0.000000] clocksource: lkl: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns\n[ 0.000002] lkl: time and timers initialized (irq1)\n[ 0.000025] pid_max: default: 4096 http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8/minimum#301;lkl/minimum;\n[ 0.000100] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)\n[ 0.000106] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)\n[ 0.017345] random: get_random_bytes called from _etext+0x726b6/0x31286a with crng_init=0\n[ 0.017524] printk: console [lkl_console0] enabled\n[ 0.017579] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns\n[ 0.017751] NET: Registered protocol family 16\n[ 0.018010] lkl_pci: probe of lkl_pci failed with error -1\n[ 0.021038] vgaarb: loaded\n[ 0.021435] clocksource: Switched to clocksource lkl\n[ 0.021802] NET: Registered protocol family 2\n[ 0.022154] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)\n[ 0.022174] TCP established hash table entries: 512 (order: 0, 4096 bytes, linear)\n[ 0.022188] TCP bind hash table entries: 512 (order: 0, 4096 bytes, linear)\n[ 0.022203] TCP: Hash tables configured (established 512 bind 512)\n[ 0.022276] UDP hash table entries: 128 (order: 0, 4096 bytes, linear)\n[ 0.022289] UDP-Lite hash table entries: 128 (order: 0, 4096 bytes, linear)\n[ 0.022356] PCI: CLS 0 bytes, default 32\n[ 0.024371] workingset: timestamp_bits=62 max_order=15 bucket_order=0\n[ 0.027573] io scheduler mq-deadline registered\n[ 0.027596] io scheduler kyber registered\n[ 0.040171] hidraw: raw HID events driver (C) Jiri Kosina\n[ 0.041969] NET: Registered protocol family 10\n[ 0.043250] Segment Routing with IPv6\n[ 0.043304] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver\n[ 0.043718] Warning: unable to open an initial console.\n[ 0.043755] This architecture does not have kernel memory protection.\n[ 0.043761] Run /init as init process\nINFO: http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8/Seed#3871312762;lkl/Seed;\nINFO: Loaded 1 modules (7670 inline 8-bit counters): 7670 [0xdbadf8, 0xdbcbee),\nINFO: Loaded 1 PC tables (7670 PCs): 7670 [0xdbcbf0,0xddab50),\n/mnt/scratch0/clusterfuzz/bot/builds/android-haiku_host-lkl-userdebug_hid-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/hid-fuzzer: Running 1 inputs 100 time(s) each.\nRunning: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-bc8061c819522a21e84cce1268b8ca6b3636ae6b\n[ 0.066768] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.066800] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.066813] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.066839] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.066851] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.066863] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.066875] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.066886] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.066898] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.066909] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.066955] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.067055] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.067067] hid-generic 0003:0405:C52B.0001: ignoring exceeding usage max\n[ 0.067768] hid-generic 0003:0405:C52B.0001: unknown main item tag 0x0\n[ 0.067779] hid-generic 0003:0405:C52B.0001: ignoring exceeding usage max\n[ 0.072770] ==================================================================\n[ 0.072808] BUG: KASAN: slab-out-of-bounds in _etext+0x26f10/0x31286a\n[ 0.072814] Write of size 4 at addr 00007f9d072ac9ec by task kworker/0:1/11\n[ 0.072819]\n[ 0.072823] Linux Kernel Library Stack Trace:\n[ 0.072839] #0 [<0x000000000063b2ea>] print_address_description+0x6a/0x5c0\n[ 0.072847] #1 [<0x000000000063ba94>] __kasan_report+0x134/0x190\n[ 0.072853] #2 [<0x000000000063afe9>] kasan_report+0x9/0x10\n[ 0.072860] #3 [<0x000000000063c1df>] __asan_store4+0x6f/0x80\n[ 0.072867] #4 [<0x0000000000ab4a86>] _etext+0x26f10/0x31286a\n[ 0.072874] #5 [<0x0000000000a9f92c>] _etext+0x11db6/0x31286a\n[ 0.072881] #6 [<0x0000000000a94d30>] _etext+0x71ba/0x31286a\n[ 0.072887] #7 [<0x0000000000a95848>] _etext+0x7cd2/0x31286a\n[ 0.072900] #8 [<0x0000000000811511>] hid_generic_probe+0xa1/0xd0\n[ 0.072906] #9 [<0x0000000000a96608>] _etext+0x8a92/0x31286a\n[ 0.072924] #10 [<0x00000000007a8e35>] really_probe+0x335/0x780\n[ 0.072934] #11 [<0x00000000007aa0e6>] __device_attach_driver+0x196/0x220\n[ 0.072941] #12 [<0x00000000007a59bd>] bus_for_each_drv+0xfd/0x140\n[ 0.072948] #13 [<0x00000000007a9429>] .L___asan_gen_.2+0x38/0xaf\n[ 0.072955] #14 [<0x00000000007a94ae>] device_initial_probe+0xe/0x10\n[ 0.072962] #15 [<0x00000000007a5c5c>] bus_probe_device+0x5c/0x100\n[ 0.072969] #16 [<0x00000000007a073f>] device_add+0xb5f/0xcb0\n[ 0.072976] #17 [<0x0000000000a971ae>] _etext+0x9638/0x31286a\n[ 0.072982] #18 [<0x0000000000abecc8>] _etext+0x31152/0x31286a\n[ 0.072998] #19 [<0x000000000059fcdc>] .str.15+0x1c/0x40\n[ 0.073006] #20 [<0x00000000005a11d8>] .str.54+0x18/0x40\n[ 0.073014] #21 [<0x00000000005a74ca>] .str.2+0x2a/0x40\n[ 0.073023] #22 [<0x000000000056f9ab>] .str.3+0x4b/0x60\n[ 0.073028] #23 [<0x00000000005697d5>] 0x5697d5\n[ 0.073033]\n[ 0.073036]\n[ 0.073040]\n[ 0.073044] Memory state around the buggy address:\n[ 0.073055] 00007f9d072ac880: 00 00 00 00 00 00 00 00 00 00 04 fe fe fe fe fe\n[ 0.073061] 00007f9d072ac900: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe\n[ 0.073067] >00007f9d072ac980: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe\n[ 0.073072] ^\n[ 0.073077] 00007f9d072aca00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe\n[ 0.073083] 00007f9d072aca80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe\n[ 0.073087] ==================================================================\n[ 0.073093] Disabling lock debugging due to kernel taint\n[ 0.073098] Kernel panic - not syncing: panic_on_warn set ...\n[ 0.073105] ---[ end Kernel panic - not syncing: panic_on_warn set ... ]---\nhid-fuzzer: lib/posix-host.c:191: void panic(void): Assertion `0' failed.\nBegin xxx\nVID=0405, PID=C52B, RDESC: 75 bytes, INPUT: 0 byetes\nRDESC::size=75\n00000000: 05 01 09 02 24 00 00 00 09 01 A1 00 81 06 7E BA ....$.........~.\n00000010: BA BA BA BA BA BA B0 95 01 00 00 00 00 00 00 00 ................\n00000020: 85 BA 02 BA BA 36 15 01 BA BA BA B0 19 01 2A 04 .....6........*.\n00000030: 03 B0 95 85 02 15 01 2A 26 FF 02 19 01 2A FF B0 .......*&....*..\n00000040: 46 02 5C 05 08 06 80 FF 81 00 C0 F.\\........\nINPUT::size=0\nUndefinedBehaviorSanitizer:DEADLYSIGNAL\n==3042094==ERROR: UndefinedBehaviorSanitizer: ABRT on unknown address 0x0539002e6b2e (pc 0x7f9d0d134438 bp 0x00000020f635 sp 0x7f9ce37fd128 T3042115)\n #0 0x7f9d0d134438 in gsignal http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8//build/glibc-e6zv40/glibc-2.23/sysdeps/unix/sysv/linux/raise.c#54;lkl//build/glibc-e6zv40/glibc-2.23/sysdeps/unix/sysv/linux/raise.c;\n #1 0x7f9d0d136039 in abort http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8//build/glibc-e6zv40/glibc-2.23/stdlib/abort.c#89;lkl//build/glibc-e6zv40/glibc-2.23/stdlib/abort.c;\n #2 0x7f9d0d12cbe6 in __assert_fail_base http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8//build/glibc-e6zv40/glibc-2.23/assert/assert.c#92;lkl//build/glibc-e6zv40/glibc-2.23/assert/assert.c;\n #3 0x7f9d0d12cc91 in __assert_fail http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8//build/glibc-e6zv40/glibc-2.23/assert/assert.c#101;lkl//build/glibc-e6zv40/glibc-2.23/assert/assert.c;\n #4 0x568f3f in panic http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8/tools/lkl/lib/posix-host.c#191;lkl/tools/lkl/lib/posix-host.c;:2\n #5 0x56f3f0 in lkl_panic_blink http://go/pakernel/lkl/+/1f26d55c741b80d2e99e529795a7f3ae34ac77a8/arch/lkl/kernel/setup.c#27;lkl/arch/lkl/kernel/setup.c;:2\nUndefinedBehaviorSanitizer can not provide additional info.\nSUMMARY: UndefinedBehaviorSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x35438)\n==3042094==ABORTING\n+----------------------------------------Release Build Unsymbolized Stacktrace (diff)----------------------------------------+\nUndefinedBehaviorSanitizer:DEADLYSIGNAL\n==3042094==ERROR: UndefinedBehaviorSanitizer: ABRT on unknown address 0x0539002e6b2e (pc 0x7f9d0d134438 bp 0x00000020f635 sp 0x7f9ce37fd128 T3042115)\n #0 0x7f9d0d134438 (/lib/x86_64-linux-gnu/libc.so.6+0x35438)\n #1 0x7f9d0d136039 (/lib/x86_64-linux-gnu/libc.so.6+0x37039)\n #2 0x7f9d0d12cbe6 (/lib/x86_64-linux-gnu/libc.so.6+0x2dbe6)\n #3 0x7f9d0d12cc91 (/lib/x86_64-linux-gnu/libc.so.6+0x2dc91)\n #4 0x568f3f (/mnt/scratch0/clusterfuzz/bot/builds/android-haiku_host-lkl-userdebug_hid-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/hid-fuzzer+0x568f3f)\n #5 0x56f3f0 (/mnt/scratch0/clusterfuzz/bot/builds/android-haiku_host-lkl-userdebug_hid-fuzzer_77651789446b3c3a04b9f492ff141f003d437347/revisions/hid-fuzzer+0x56f3f0)", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/log_fatal_google.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@log_fatal_google.txt.snap similarity index 96% rename from src/agent/libclusterfuzz/data/parsed-traces/log_fatal_google.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@log_fatal_google.txt.snap index 1589a90875..29a4e51b0d 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/log_fatal_google.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@log_fatal_google.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/log_fatal_google.txt +--- { "text": "F0812 20:32:32.874783 47273 file.h:195] Log fatal.\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==47273==ERROR: AddressSanitizer: ABRT on unknown address 0x05390000b8a9 (pc 0x7fb149fee602 bp 0x7ffe9a107800 sp 0x7ffe9a1076d8 T0)\nSCARINESS: 10 (signal)\n #0 0x7fd6607ef601 in raise (/usr/grte/v4/lib64/libc.so.6+0xfffff)\n #1 0x7fd6607f131f in abort (/usr/grte/v4/lib64/libc.so.6+0xfffff)\n #10 0x5585f338030f in Frame(int) file/path.cc:87:9\n #11 0x5585f33815b2 in LLVMFuzzerTestOneInput file/path.cc:98:1\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/lsan_direct_leak.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lsan_direct_leak.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/lsan_direct_leak.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@lsan_direct_leak.txt.snap index b475d336a1..fb13133989 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/lsan_direct_leak.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lsan_direct_leak.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/lsan_direct_leak.txt +--- { "text": "[3236:3236:0629/123027:ERROR:browser_main_loop.cc(189)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.\n[3294:3294:0629/123027:ERROR:renderer_main.cc(200)] Running without renderer sandbox\n[3349:3349:0629/123028:ERROR:renderer_main.cc(200)] Running without renderer sandbox\ncompilation error: file line 1 element output\ninvalid value for method: undefined\n\n=================================================================\n==3236==ERROR: LeakSanitizer: detected memory leaks\n\nIndirect leak of 3079 byte(s) in 252 object(s) allocated from:\n #0 0x7f3b595f8acb in __interceptor_malloc ??:?\n #1 0x7f3b4ed87839 in __GI___strdup /build/buildd/eglibc-2.19/string/strdup.c:42\n\n-----------------------------------------------------\nSuppressions used:\n count bytes template\n 360 17792 libfontconfig\n-----------------------------------------------------\n\nSUMMARY: AddressSanitizer: 3079 byte(s) leaked in 252 allocation(s).\n\n=================================================================\n==3294==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 10 byte(s) in 1 object(s) allocated from:\n #0 0x7fef9d463acb in __interceptor_malloc ??:?\n #1 0x7fefa091110b in xmlStrndup /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/libxml/src/xmlstring.c:45\n #2 0x7fefa09112f7 in xmlStrdup /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/libxml/src/xmlstring.c:71\n #3 0x7fefa088726b in xmlGetPropNodeValueInternal /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/libxml/src/tree.c:6593\n #4 0x7fefa0884779 in xmlGetNsProp /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/libxml/src/tree.c:6744\n #5 0x7fefadf0440e in xsltParseStylesheetOutput /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/libxslt/libxslt/xslt.c:1186\n #6 0x7fefadf0d815 in xsltParseStylesheetTop /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/libxslt/libxslt/xslt.c:6150\n #7 0x7fefadf08c56 in xsltParseStylesheetProcess /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/libxslt/libxslt/xslt.c:6428\n #8 0x7fefadf0e47c in xsltParseStylesheetImportedDoc /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/libxslt/libxslt/xslt.c:6641\n #9 0x7fefadf0f131 in xsltParseStylesheetDoc /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/libxslt/libxslt/xslt.c:6680\n #10 0x7fefa4b2a216 in blink::XSLStyleSheet::compileStyleSheet() /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/WebKit/Source/core/xml/XSLStyleSheetLibxslt.cpp:250\n #11 0x7fefa4b3155b in xsltStylesheetPointer /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/WebKit/Source/core/xml/XSLTProcessorLibxslt.cpp:240\n #12 0x7fefa4b302d7 in transformToString /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/WebKit/Source/core/xml/XSLTProcessorLibxslt.cpp:283\n #13 0x7fefa4b2f5c8 in blink::XSLTProcessor::transformToDocument(blink::Node*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/WebKit/Source/core/xml/XSLTProcessor.cpp:113\n #14 0x7fefa588e23b in transformToDocumentMethod /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/gen/blink/bindings/core/v8/V8XSLTProcessor.cpp:110\n #15 0x7fefa588d2f6 in blink::XSLTProcessorV8Internal::transformToDocumentMethodCallback(v8::FunctionCallbackInfo const&) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/gen/blink/bindings/core/v8/V8XSLTProcessor.cpp:116\n #16 0x7fefa26651e1 in Call /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/arguments.cc:33\n #17 0x7fefa1c8eb45 in HandleApiCallHelper /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/builtins.cc:1092\n #18 0x7fefa1c9d040 in Builtin_implHandleApiCall /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/builtins.cc:1115 (discriminator 1)\n #19 0x7fefa1c8ff2f in v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/builtins.cc:1111\n #20 0x7fee08409afa ()\n #21 0x7fee0850fbd6 ()\n #22 0x7fee0840a436 ()\n #23 0x7fee0850f8d8 ()\n #24 0x7fee0843145c ()\n #25 0x7fee084166e1 ()\n #20 0x7fefa1de7f70 in Invoke /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/execution.cc:128\n #21 0x7fefa1de6efc in Call /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/execution.cc:179\n #22 0x7fefa1bc9862 in Run /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../v8/src/api.cc:1687\n #23 0x7fefa56fe04d in blink::V8ScriptRunner::runCompiledScript(v8::Isolate*, v8::Local, blink::ExecutionContext*) /mnt/data/b/build/slave/ASAN_Release__symbolized_/build/src/out/Release/../../third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp:391\n\nSUMMARY: AddressSanitizer: 10 byte(s) leaked in 1 allocation(s).\n[0629/123031:ERROR:nacl_helper_linux.cc(317)] NaCl helper process running without a sandbox!\nMost likely you need to configure your SUID sandbox correctly\n-----------------------------------------------------\nSuppressions used:\n count bytes template\n 3 18072 libGL.so\n-----------------------------------------------------\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/lsan_indirect_leak_cycle.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lsan_indirect_leak_cycle.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/lsan_indirect_leak_cycle.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@lsan_indirect_leak_cycle.txt.snap index d742be427c..3b9ce577fb 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/lsan_indirect_leak_cycle.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lsan_indirect_leak_cycle.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/lsan_indirect_leak_cycle.txt +--- { "text": "=================================================================\n==1==ERROR: LeakSanitizer: detected memory leaks\n\nIndirect leak of 96 byte(s) in 2 object(s) allocated from:\n #0 0x4d5058 in malloc _asan_rtl_\n #1 0x80469a in xmlNewDocElementContent /src/libxml2/valid.c:952:34\n #2 0x6c92c9 in xmlParseElementMixedContentDecl /src/libxml2/parser.c:6262:11\n #3 0x6cfde3 in xmlParseElementContentDecl /src/libxml2/parser.c:6677:16\n #4 0x6d2a96 in xmlParseElementDecl /src/libxml2/parser.c:6745:12\n #5 0x6d3d93 in xmlParseMarkupDecl /src/libxml2/parser.c:6997:4\n #6 0x718cb8 in xmlParseInternalSubset /src/libxml2/parser.c:8473:6\n #7 0x717142 in xmlParseDocument /src/libxml2/parser.c:10921:6\n #8 0x7455d0 in xmlDoRead /src/libxml2/parser.c:15432:5\n #9 0x745a32 in xmlReadMemory /src/libxml2/parser.c:15518:13\n #10 0x512b96 in LLVMFuzzerTestOneInput /src/libxml2_xml_read_memory_fuzzer.cc:17:18\n #11 0x589918 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:550:13\n #12 0x58a664 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:501:3\n #13 0x5912b5 in fuzzer::Fuzzer::MutateAndTestOne() /src/libfuzzer/FuzzerLoop.cpp:757:30\n #14 0x592323 in fuzzer::Fuzzer::Loop() /src/libfuzzer/FuzzerLoop.cpp:791:5\n #15 0x521899 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:567:6\n #16 0x512dd8 in main /src/libfuzzer/FuzzerMain.cpp:20:10\n #17 0x7f68b269182f in __libc_start_main\n\nIndirect leak of 96 byte(s) in 2 object(s) allocated from:\n #0 0x4d5058 in malloc _asan_rtl_\n #1 0x80469a in xmlNewDocElementContent /src/libxml2/valid.c:952:34\n #2 0x6c924e in xmlParseElementMixedContentDecl /src/libxml2/parser.c:6260:14\n #3 0x6cfde3 in xmlParseElementContentDecl /src/libxml2/parser.c:6677:16\n #4 0x6d2a96 in xmlParseElementDecl /src/libxml2/parser.c:6745:12\n #5 0x6d3d93 in xmlParseMarkupDecl /src/libxml2/parser.c:6997:4\n #6 0x718cb8 in xmlParseInternalSubset /src/libxml2/parser.c:8473:6\n #7 0x717142 in xmlParseDocument /src/libxml2/parser.c:10921:6\n #8 0x7455d0 in xmlDoRead /src/libxml2/parser.c:15432:5\n #9 0x745a32 in xmlReadMemory /src/libxml2/parser.c:15518:13\n #10 0x512b96 in LLVMFuzzerTestOneInput /src/libxml2_xml_read_memory_fuzzer.cc:17:18\n #11 0x589918 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:550:13\n #12 0x58a664 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:501:3\n #13 0x5912b5 in fuzzer::Fuzzer::MutateAndTestOne() /src/libfuzzer/FuzzerLoop.cpp:757:30\n #14 0x592323 in fuzzer::Fuzzer::Loop() /src/libfuzzer/FuzzerLoop.cpp:791:5\n #15 0x521899 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:567:6\n #16 0x512dd8 in main /src/libfuzzer/FuzzerMain.cpp:20:10\n #17 0x7f68b269182f in __libc_start_main\n\nIndirect leak of 48 byte(s) in 1 object(s) allocated from:\n #0 0x4d5058 in malloc _asan_rtl_\n #1 0x80469a in xmlNewDocElementContent /src/libxml2/valid.c:952:34\n #2 0x6c8e89 in xmlParseElementMixedContentDecl /src/libxml2/parser.c:6247:18\n #3 0x6cfde3 in xmlParseElementContentDecl /src/libxml2/parser.c:6677:16\n #4 0x6d2a96 in xmlParseElementDecl /src/libxml2/parser.c:6745:12\n #5 0x6d3d93 in xmlParseMarkupDecl /src/libxml2/parser.c:6997:4\n #6 0x718cb8 in xmlParseInternalSubset /src/libxml2/parser.c:8473:6\n #7 0x717142 in xmlParseDocument /src/libxml2/parser.c:10921:6\n #8 0x7455d0 in xmlDoRead /src/libxml2/parser.c:15432:5\n #9 0x745a32 in xmlReadMemory /src/libxml2/parser.c:15518:13\n #10 0x512b96 in LLVMFuzzerTestOneInput /src/libxml2_xml_read_memory_fuzzer.cc:17:18\n #11 0x589918 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:550:13\n #12 0x58a664 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:501:3\n #13 0x5912b5 in fuzzer::Fuzzer::MutateAndTestOne() /src/libfuzzer/FuzzerLoop.cpp:757:30\n #14 0x592323 in fuzzer::Fuzzer::Loop() /src/libfuzzer/FuzzerLoop.cpp:791:5\n #15 0x521899 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:567:6\n #16 0x512dd8 in main /src/libfuzzer/FuzzerMain.cpp:20:10\n #17 0x7f68b269182f in __libc_start_main\n\nIndirect leak of 48 byte(s) in 1 object(s) allocated from:\n #0 0x4d5058 in malloc _asan_rtl_\n #1 0x80469a in xmlNewDocElementContent /src/libxml2/valid.c:952:34\n #2 0x6c90f0 in xmlParseElementMixedContentDecl /src/libxml2/parser.c:6253:16\n #3 0x6cfde3 in xmlParseElementContentDecl /src/libxml2/parser.c:6677:16\n #4 0x6d2a96 in xmlParseElementDecl /src/libxml2/parser.c:6745:12\n #5 0x6d3d93 in xmlParseMarkupDecl /src/libxml2/parser.c:6997:4\n #6 0x718cb8 in xmlParseInternalSubset /src/libxml2/parser.c:8473:6\n #7 0x717142 in xmlParseDocument /src/libxml2/parser.c:10921:6\n #8 0x7455d0 in xmlDoRead /src/libxml2/parser.c:15432:5\n #9 0x745a32 in xmlReadMemory /src/libxml2/parser.c:15518:13\n #10 0x512b96 in LLVMFuzzerTestOneInput /src/libxml2_xml_read_memory_fuzzer.cc:17:18\n #11 0x589918 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:550:13\n #12 0x58a664 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:501:3\n #13 0x5912b5 in fuzzer::Fuzzer::MutateAndTestOne() /src/libfuzzer/FuzzerLoop.cpp:757:30\n #14 0x592323 in fuzzer::Fuzzer::Loop() /src/libfuzzer/FuzzerLoop.cpp:791:5\n #15 0x521899 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:567:6\n #16 0x512dd8 in main /src/libfuzzer/FuzzerMain.cpp:20:10\n #17 0x7f68b269182f in __libc_start_main\n\nSUMMARY: AddressSanitizer: 288 byte(s) leaked in 6 allocation(s).\nINFO: to ignore leaks on libFuzzer side use -detect_leaks=0.", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/lsan_multiple_leaks.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lsan_multiple_leaks.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/lsan_multiple_leaks.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@lsan_multiple_leaks.txt.snap index af9e705507..827e018222 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/lsan_multiple_leaks.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lsan_multiple_leaks.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/lsan_multiple_leaks.txt +--- { "text": "[30919:30919:0806/225106:ERROR:browser_main_loop.cc(194)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.\nXlib: extension \"RANDR\" missing on display \":1\".\nXlib: extension \"RANDR\" missing on display \":1\".\n[31021:31021:0806/225110:ERROR:renderer_main.cc(190)] Running without renderer sandbox\nNOT SANDBOXED\n-----------------------------------------------------\nSuppressions used:\n count bytes template\n 581 16883 libfontconfig\n-----------------------------------------------------\n\n=================================================================\n==31049==ERROR: LeakSanitizer: detected memory leaks\nDirect leak of 196608 byte(s) in 3 object(s) allocated from:\n #0 0x7f1d1174876b in operator new[](unsigned long)\n #1 0x7f1bb40eebec in pepper::AutoBuffer::AllocateBuffer(unsigned long) /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/base/pep_auto_buffer.cpp:69\n #2 0x1cac3294459a93ff ()\n\nDirect leak of 18240 byte(s) in 190 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb4b4ddbf in std::tr1::_Hashtable, std::allocator >, std::_Select1st >, std::equal_to, std::tr1::hash, std::tr1::__detail::_Mod_range_hashing, std::tr1::__detail::_Default_ranged_hash, std::tr1::__detail::_Prime_rehash_policy, false, false, true>::_M_allocate_buckets(unsigned long) /usr/include/c++/4.4/ext/new_allocator.h:89\n\nDirect leak of 4352 byte(s) in 34 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb4b5da9b in PlatformSocketAddress::PlatformSocketAddress() /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/pep_socket_address.cpp:56\n\nDirect leak of 1680 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40fc1b5 in PepperDisplayContext3D::PepperDisplayContext3D(MMgc::GCAPI::GCRef, SPOINT const&) /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/pep_displaycontext.cpp:391\n\nDirect leak of 1536 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40de625 in PlatformPlayer::PlatformPlayer(PlatformGlobals*, MMgc::GC*, CorePlayer*) /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/pep_player.cpp:143\n\nDirect leak of 1440 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb3c9cf78 (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbef78)\n\nDirect leak of 528 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40de5a4 in PlatformPlayer::PlatformPlayer(PlatformGlobals*, MMgc::GC*, CorePlayer*) /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/pep_player.cpp:143\n\nDirect leak of 384 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40dd448 in PlatformPlayer::Init(pepper::Instance*) /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/pep_player.cpp:210\n\nDirect leak of 384 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40e652a in SoundMix::Create(CorePlayer*) /usr/include/c++/4.4/ext/new_allocator.h:89\n\nDirect leak of 336 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40de6d7 in PlatformPlayer::PlatformPlayer(PlatformGlobals*, MMgc::GC*, CorePlayer*) /home/rtcbldr/ws/St_Make/code/third_party/ppapi/utility/completion_callback_factory.h:836\n\nDirect leak of 336 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40fbea3 in PepperDisplayContext3D::PepperDisplayContext3D(MMgc::GCAPI::GCRef, SPOINT const&) /home/rtcbldr/ws/St_Make/code/third_party/ppapi/utility/completion_callback_factory.h:836\n\nDirect leak of 192 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40f7635 in std::vector >::operator=(std::vector > const&) /usr/include/c++/4.4/ext/new_allocator.h:89\n\nDirect leak of 96 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40fc0e9 in PepperDisplayContext3D::PepperDisplayContext3D(MMgc::GCAPI::GCRef, SPOINT const&) /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/pep_displaycontext.cpp:381\n\nDirect leak of 96 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40de55a in PlatformPlayer::PlatformPlayer(PlatformGlobals*, MMgc::GC*, CorePlayer*) /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/pep_player.cpp:143\n\nDirect leak of 64 byte(s) in 1 object(s) allocated from:\n #0 0x7f1d117269bb in __interceptor_malloc\n #1 0x7f1bb4386c69 in MMgc::BasicList::Add(CorePlayer*) /home/rtcbldr/ws/St_Make/code/third_party/avmplus/MMgc/Shared-inlines.h:65\n\nDirect leak of 48 byte(s) in 3 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb41129aa in pepper::internal::MicrophoneManagerImpl::DoEnumerateDevices(int) /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/pep_microphone_manager.cpp:107\n\nDirect leak of 32 byte(s) in 1 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40fc9fd in std::vector >::_M_fill_insert(__gnu_cxx::__normal_iterator > >, unsigned long, IVideoPlane* const&) /usr/include/c++/4.4/ext/new_allocator.h:89\n\nDirect leak of 32 byte(s) in 2 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb44c691d in coreplayer::ComponentFactory::CreateCapabilities(avmplus::CapabilitiesClass*) /home/rtcbldr/ws/St_Make/code/flash/core/splayer.cpp:33562\n\nIndirect leak of 3072 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40e654d in SoundMix::Create(CorePlayer*) /usr/include/c++/4.4/ext/new_allocator.h:89\n\nIndirect leak of 1488 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40de749 in PlatformPlayer::PlatformPlayer(PlatformGlobals*, MMgc::GC*, CorePlayer*) /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/pep_player.cpp:143\n\nIndirect leak of 1448 byte(s) in 44 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb3c9cf78 (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbef78)\n\nIndirect leak of 1056 byte(s) in 44 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb4b4e494 in std::tr1::_Hashtable, std::allocator >, std::_Select1st >, std::equal_to, std::tr1::hash, std::tr1::__detail::_Mod_range_hashing, std::tr1::__detail::_Default_ranged_hash, std::tr1::__detail::_Prime_rehash_policy, false, false, true>::_M_insert_bucket(std::pair const&, unsigned long, unsigned long) /usr/include/c++/4.4/ext/new_allocator.h:89\n #2 0x7f1affffffff ()\n\nIndirect leak of 624 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40de579 in PlatformPlayer::PlatformPlayer(PlatformGlobals*, MMgc::GC*, CorePlayer*) /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/pep_player.cpp:143\n\nIndirect leak of 624 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40de769 in PlatformPlayer::PlatformPlayer(PlatformGlobals*, MMgc::GC*, CorePlayer*) /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/pep_player.cpp:143\n\nIndirect leak of 336 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40f6faa in PlatformCameraManager::PlatformCameraManager(PlatformPlayer*) /home/rtcbldr/ws/St_Make/code/third_party/ppapi/utility/completion_callback_factory.h:836\n\nIndirect leak of 336 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40f588f in pepper::PepperBroker::PepperBroker(PlatformPlayer*) /home/rtcbldr/ws/St_Make/code/third_party/ppapi/utility/completion_callback_factory.h:836\n\nIndirect leak of 336 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb4118be9 in internal::WeakReferenceOwner::GetRef() const /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/base/pep_weak_ptr.cpp:45\n\nIndirect leak of 336 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb4100ab2 in pepper::FileChooserHelper::FileChooserHelper(PlatformPlayer*) /home/rtcbldr/ws/St_Make/code/third_party/ppapi/utility/completion_callback_factory.h:836\n\nIndirect leak of 160 byte(s) in 1 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40de69a in PlatformPlayer::PlatformPlayer(PlatformGlobals*, MMgc::GC*, CorePlayer*) /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/pep_player.cpp:143\n\nIndirect leak of 96 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40f7635 in std::vector >::operator=(std::vector > const&) /usr/include/c++/4.4/ext/new_allocator.h:89\n\nIndirect leak of 96 byte(s) in 6 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40fc07d in PepperDisplayContext3D::PepperDisplayContext3D(MMgc::GCAPI::GCRef, SPOINT const&) /home/rtcbldr/ws/St_Make/code/flash/platform/pepper/pep_displaycontext.cpp:378\n\nIndirect leak of 56 byte(s) in 1 object(s) allocated from:\n #0 0x7f1d117485fb in operator new(unsigned long)\n #1 0x7f1bb40ff2bd in pepper::EventManager::EventManager(pepper::EventManagerClient*) /home/rtcbldr/ws/St_Make/code/third_party/ppapi/utility/completion_callback_factory.h:836\n\nSUMMARY: AddressSanitizer: 236448 byte(s) leaked in 450 allocation(s).\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/lsan_single_frame_stacks.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lsan_single_frame_stacks.txt.snap similarity index 92% rename from src/agent/libclusterfuzz/data/parsed-traces/lsan_single_frame_stacks.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@lsan_single_frame_stacks.txt.snap index ffabc94b80..e80dc3973e 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/lsan_single_frame_stacks.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@lsan_single_frame_stacks.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/lsan_single_frame_stacks.txt +--- { "text": "-----------------------------------------------------\nSuppressions used:\n count bytes template\n 581 16883 libfontconfig\n-----------------------------------------------------\n\n=================================================================\n==31049==ERROR: LeakSanitizer: detected memory leaks\nDirect leak of 1 byte(s) in 1 object(s) allocated from:\n #0 0x7f1d1174876b in f(unsigned long) /usr/include/blah.h:88\n\nDirect leak of 1 byte(s) in 1 object(s) allocated from:\n #0 0x7f1d1174876c in g(unsigned long) /usr/include/blah.h:89\n\nSUMMARY: AddressSanitizer: 2 byte(s) leaked in 2 allocation(s).\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/msan_browser.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@msan_browser.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/msan_browser.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@msan_browser.txt.snap index fc01b787ce..e9dc7892a8 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/msan_browser.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@msan_browser.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/msan_browser.txt +--- { "text": "==8966==WARNING: MemorySanitizer: use-of-uninitialized-value\n #0 0x7fbe995caeff in gfx::Transform::TransformPointInternal(SkMatrix44 const&, gfx::Point3F*) const ui/gfx/transform.cc:520:27\n #1 0x7fbe995cb2ca in gfx::Transform::TransformPointReverse(gfx::Point3F*) const ui/gfx/transform.cc:435:3\n #2 0x7fbea53d897d in ConvertPointFromAncestor ui/views/view.cc:2058:3\n #3 0x7fbea53d897d in ConvertPointFromWidget ui/views/view.cc:695\n #4 0x7fbea53d897d in views::View::ConvertPointFromScreen(views::View const*, gfx::Point*) ui/views/view.cc:720\n #5 0x7fbea53dc145 in views::View::IsMouseHovered() const ui/views/view.cc:958:3\n #6 0x7fbea2907c01 in ReloadButton::ChangeMode(ReloadButton::Mode, bool) chrome/browser/ui/views/toolbar/reload_button.cc:67:18\n #7 0x7fbea2a75e64 in UpdateReloadStopState chrome/browser/ui/browser_command_controller.cc:1205:3\n #8 0x7fbea2a75e64 in chrome::BrowserCommandController::LoadingStateChanged(bool, bool) chrome/browser/ui/browser_command_controller.cc:277\n #9 0x7fbea2a5fa4b in Browser::LoadingStateChanged(content::WebContents*, bool) chrome/browser/ui/browser.cc:1601:5\n #10 0x7fbea3de2156 in content::WebContentsImpl::LoadingStateChanged(bool, bool, content::LoadNotificationDetails*) content/browser/web_contents/web_contents_impl.cc:3818:5\n #11 0x7fbea3e06d9e in content::WebContentsImpl::DidStopLoading() content/browser/web_contents/web_contents_impl.cc:4226:3\n #12 0x7fbea431aa5d in content::FrameTreeNode::DidStopLoading() content/browser/frame_host/frame_tree_node.cc:419:5\n #13 0x7fbea37c7208 in content::RenderFrameHostImpl::OnDidStopLoading() content/browser/frame_host/render_frame_host_impl.cc:1844:5\n #14 0x7fbea3ce4f86 in content::SiteInstanceImpl::RenderProcessExited(content::RenderProcessHost*, base::TerminationStatus, int) content/browser/site_instance_impl.cc:414:3\n #15 0x7fbea3a30bcd in content::RenderProcessHostImpl::ProcessDied(bool, content::RenderProcessHost::RendererClosedDetails*) content/browser/renderer_host/render_process_host_impl.cc:2459:3\n #16 0x7fbea3a2fc33 in content::RenderProcessHostImpl::FastShutdownIfPossible() content/browser/renderer_host/render_process_host_impl.cc:1705:3\n #17 0x7fbe967ba3af in browser_shutdown::OnShutdownStarting(browser_shutdown::ShutdownType) chrome/browser/browser_shutdown.cc:135:10\n #18 0x7fbe963a64a4 in chrome::SessionEnding() chrome/browser/lifetime/application_lifetime.cc:274:3\n #19 0x7fbe961623f5 in (anonymous namespace)::BrowserX11IOErrorHandler(_XDisplay*) chrome/browser/chrome_browser_main_extra_parts_x11.cc:63:3\n #20 0x7fbe90e3c1f9 in _XIOError out-msan-no-origins-trusty/Release/obj/third_party/instrumented_libraries/msan-libx11-6.gen/libx11-6/libx11-1.6.2/src/XlibInt.c:1498:2\n #21 0x7fbe90e33d20 in _XEventsQueued out-msan-no-origins-trusty/Release/obj/third_party/instrumented_libraries/msan-libx11-6.gen/libx11-6/libx11-1.6.2/src/xcb_io.c:366:4\n #22 0x7fbe90e02161 in XPending out-msan-no-origins-trusty/Release/obj/third_party/instrumented_libraries/msan-libx11-6.gen/libx11-6/libx11-1.6.2/src/Pending.c:55:12\n #23 0x7fbe940bc9f1 in g_main_context_check out-msan-no-origins-trusty/Release/obj/third_party/instrumented_libraries/msan-libglib2.0-0.gen/libglib2.0-0/glib2.0-2.40.2/glib/gmain.c:3575:24\n #24 0x7fbe940bdf7b in g_main_context_iterate out-msan-no-origins-trusty/Release/obj/third_party/instrumented_libraries/msan-libglib2.0-0.gen/libglib2.0-0/glib2.0-2.40.2/glib/gmain.c:3731:16\n #25 0x7fbe940be166 in g_main_context_iteration out-msan-no-origins-trusty/Release/obj/third_party/instrumented_libraries/msan-libglib2.0-0.gen/libglib2.0-0/glib2.0-2.40.2/glib/gmain.c:3795:12\n #26 0x7fbe9730b458 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_glib.cc:309:30\n #27 0x7fbe971f378a in base::RunLoop::Run() base/run_loop.cc:35:3\n #28 0x7fbe9680f694 in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1855:3\n #29 0x7fbea410e2a1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:935:21\n #30 0x7fbea3686e7b in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:154:5\n #31 0x7fbea368506e in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:46:15\n #32 0x7fbe9701f781 in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:381:14\n #33 0x7fbe9702265a in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:742:12\n #34 0x7fbe9701b875 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:20:15\n #35 0x7fbe95db2f53 in ChromeMain chrome/app/chrome_main.cc:84:12\n #36 0x7fbe95db2d7f in main chrome/app/chrome_exe_main_aura.cc:17:10\n #37 0x7fbe8bc5cec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287\n #38 0x7fbe95d4b3c4 in _start\n", "sanitizer": "MemorySanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/msan_renderer.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@msan_renderer.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/msan_renderer.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@msan_renderer.txt.snap index 0b38a40145..a5e424d7ac 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/msan_renderer.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@msan_renderer.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/msan_renderer.txt +--- { "text": "==1==WARNING: MemorySanitizer: use-of-uninitialized-value\n #0 0x7fb5e67afa71 in blink::LayoutBox::addOverflowFromChild(blink::LayoutBox*, blink::LayoutSize const&) third_party/WebKit/Source/core/layout/LayoutBox.cpp:4074:9\n #1 0x7fb5e6b61bea in addOverflowFromChild third_party/WebKit/Source/core/layout/LayoutBox.h:387:51\n #2 0x7fb5e6b61bea in blink::LayoutTableSection::computeOverflowFromCells(unsigned int, unsigned int) third_party/WebKit/Source/core/layout/LayoutTableSection.cpp:1119\n #3 0x7fb5e6b632e5 in blink::LayoutTableSection::recalcChildOverflowAfterStyleChange() third_party/WebKit/Source/core/layout/LayoutTableSection.cpp:1164:9\n #4 0x7fb5e6ad6d4d in blink::LayoutTable::recalcChildOverflowAfterStyleChange() third_party/WebKit/Source/core/layout/LayoutTable.cpp:425:36\n #5 0x7fb5e664f933 in blink::LayoutBlock::recalcOverflowAfterStyleChange() third_party/WebKit/Source/core/layout/LayoutBlock.cpp:2759:35\n #6 0x7fb5e6650706 in recalcNormalFlowChildOverflowIfNeeded third_party/WebKit/Source/core/layout/LayoutBlock.cpp:2717:12\n #7 0x7fb5e6650706 in blink::LayoutBlock::recalcChildOverflowAfterStyleChange() third_party/WebKit/Source/core/layout/LayoutBlock.cpp:2732\n #8 0x7fb5e664f933 in blink::LayoutBlock::recalcOverflowAfterStyleChange() third_party/WebKit/Source/core/layout/LayoutBlock.cpp:2759:35\n #9 0x7fb5e6650706 in recalcNormalFlowChildOverflowIfNeeded third_party/WebKit/Source/core/layout/LayoutBlock.cpp:2717:12\n #10 0x7fb5e6650706 in blink::LayoutBlock::recalcChildOverflowAfterStyleChange() third_party/WebKit/Source/core/layout/LayoutBlock.cpp:2732\n #11 0x7fb5e664f933 in blink::LayoutBlock::recalcOverflowAfterStyleChange() third_party/WebKit/Source/core/layout/LayoutBlock.cpp:2759:35\n #12 0x7fb5e6650706 in recalcNormalFlowChildOverflowIfNeeded third_party/WebKit/Source/core/layout/LayoutBlock.cpp:2717:12\n #13 0x7fb5e6650706 in blink::LayoutBlock::recalcChildOverflowAfterStyleChange() third_party/WebKit/Source/core/layout/LayoutBlock.cpp:2732\n #14 0x7fb5e664f933 in blink::LayoutBlock::recalcOverflowAfterStyleChange() third_party/WebKit/Source/core/layout/LayoutBlock.cpp:2759:35\n #15 0x7fb5e52c6bd0 in blink::FrameView::recalcOverflowAfterStyleChange() third_party/WebKit/Source/core/frame/FrameView.cpp:632:5\n #16 0x7fb5e3542f90 in blink::Document::updateStyle() third_party/WebKit/Source/core/dom/Document.cpp:1807:5\n #17 0x7fb5e352802d in blink::Document::updateLayoutTree() third_party/WebKit/Source/core/dom/Document.cpp:1736:5\n #18 0x7fb5e5303a30 in blink::FrameView::updateStyleAndLayoutIfNeededRecursiveInternal() third_party/WebKit/Source/core/frame/FrameView.cpp:2587:5\n #19 0x7fb5e52fdca9 in blink::FrameView::updateStyleAndLayoutIfNeededRecursive() third_party/WebKit/Source/core/frame/FrameView.cpp:2570:5\n #20 0x7fb5e52fb48a in blink::FrameView::updateLifecyclePhasesInternal(blink::FrameView::LifeCycleUpdateOption) third_party/WebKit/Source/core/frame/FrameView.cpp:2416:5\n #21 0x7fb5e5b08bd9 in blink::PageAnimator::updateAllLifecyclePhases(blink::LocalFrame&) third_party/WebKit/Source/core/page/PageAnimator.cpp:82:5\n #22 0x7fb5e0bdf5fc in blink::WebViewImpl::updateAllLifecyclePhases() third_party/WebKit/Source/web/WebViewImpl.cpp:1975:5\n #23 0x7fb5eebad25c in content::RenderWidgetCompositor::UpdateLayerTreeHost() content/renderer/gpu/render_widget_compositor.cc:921:3\n #24 0x7fb5f3a32879 in cc::ProxyMain::BeginMainFrame(std::__1::unique_ptr >) cc/trees/proxy_main.cc:206:3\n #25 0x7fb5f3a6cc80 in Run > > base/bind_internal.h:181:12\n #26 0x7fb5f3a6cc80 in MakeItSo, std::__1::unique_ptr > > base/bind_internal.h:334\n #27 0x7fb5f3a6cc80 in base::internal::Invoker, base::internal::BindState >)>, void (cc::ProxyMain*, std::__1::unique_ptr >), base::WeakPtr&, base::internal::PassedWrapper > > >, base::internal::InvokeHelper >)> >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:372\n #28 0x7fb5d85bb7d9 in Run base/callback.h:397:12\n #29 0x7fb5d85bb7d9 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51\n #30 0x7fb5f7a119c4 in scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(scheduler::internal::WorkQueue*, scheduler::internal::TaskQueueImpl::Task*) components/scheduler/base/task_queue_manager.cc:289:3\n #31 0x7fb5f7a09c20 in scheduler::TaskQueueManager::DoWork(base::TimeTicks, bool) components/scheduler/base/task_queue_manager.cc:201:13\n #32 0x7fb5f7a19b0d in Run base/bind_internal.h:181:12\n #33 0x7fb5f7a19b0d in MakeItSo, const base::TimeTicks &, const bool &> base/bind_internal.h:334\n #34 0x7fb5f7a19b0d in base::internal::Invoker, base::internal::BindState, void (scheduler::TaskQueueManager*, base::TimeTicks, bool), base::WeakPtr, base::TimeTicks&, bool>, base::internal::InvokeHelper >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:372\n #35 0x7fb5d85bb7d9 in Run base/callback.h:397:12\n #36 0x7fb5d85bb7d9 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51\n #37 0x7fb5d8375ecb in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:479:3\n #38 0x7fb5d8377f3c in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:488:5\n #39 0x7fb5d8379a64 in base::MessageLoop::DoDelayedWork(base::TimeTicks*) base/message_loop/message_loop.cc:638:10\n #40 0x7fb5d8388ead in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:37:17\n #41 0x7fb5d841f226 in base::RunLoop::Run() base/run_loop.cc:35:3\n #42 0x7fb5d8371ebd in base::MessageLoop::Run() base/message_loop/message_loop.cc:295:3\n #43 0x7fb5ee63dbd1 in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:219:7\n #44 0x7fb5d817022f in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:306:14\n #45 0x7fb5d817380b in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:389:12\n #46 0x7fb5d8177779 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:742:12\n #47 0x7fb5d816e3d6 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:20:15\n #48 0x7fb5d6722e69 in ChromeMain chrome/app/chrome_main.cc:84:12\n #49 0x7fb5d6722bf1 in main chrome/app/chrome_exe_main_aura.cc:17:10\n #50 0x7fb5cb080ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287\n #51 0x7fb5d66bb224 in _start\n Uninitialized value was created by a heap deallocation\n #0 0x7fb5d66d97b2 in __interceptor_free\n #1 0x7fb5e37dcdb8 in blink::Node::detach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/dom/Node.cpp:843:9\n #2 0x7fb5e3494db0 in blink::ContainerNode::detach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/dom/ContainerNode.cpp:763:5\n #3 0x7fb5e36a006b in blink::Element::detach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/dom/Element.cpp:1579:5\n #4 0x7fb5e37dc7a6 in blink::Node::reattach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/dom/Node.cpp:820:9\n #5 0x7fb5e36a61c0 in blink::Element::recalcOwnStyle(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/Element.cpp:1751:9\n #6 0x7fb5e36a408c in blink::Element::recalcStyle(blink::StyleRecalcChange, blink::Text*) third_party/WebKit/Source/core/dom/Element.cpp:1691:22\n #7 0x7fb5e349fd4f in blink::ContainerNode::recalcChildStyle(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/ContainerNode.cpp:1199:17\n #8 0x7fb5e36a4ab8 in blink::Element::recalcStyle(blink::StyleRecalcChange, blink::Text*) third_party/WebKit/Source/core/dom/Element.cpp:1707:13\n #9 0x7fb5e349fd4f in blink::ContainerNode::recalcChildStyle(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/ContainerNode.cpp:1199:17\n #10 0x7fb5e36a4ab8 in blink::Element::recalcStyle(blink::StyleRecalcChange, blink::Text*) third_party/WebKit/Source/core/dom/Element.cpp:1707:13\n #11 0x7fb5e349fd4f in blink::ContainerNode::recalcChildStyle(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/ContainerNode.cpp:1199:17\n #12 0x7fb5e36a4ab8 in blink::Element::recalcStyle(blink::StyleRecalcChange, blink::Text*) third_party/WebKit/Source/core/dom/Element.cpp:1707:13\n #13 0x7fb5e349fd4f in blink::ContainerNode::recalcChildStyle(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/ContainerNode.cpp:1199:17\n #14 0x7fb5e36a4ab8 in blink::Element::recalcStyle(blink::StyleRecalcChange, blink::Text*) third_party/WebKit/Source/core/dom/Element.cpp:1707:13\n #15 0x7fb5e349fd4f in blink::ContainerNode::recalcChildStyle(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/ContainerNode.cpp:1199:17\n #16 0x7fb5e36a4ab8 in blink::Element::recalcStyle(blink::StyleRecalcChange, blink::Text*) third_party/WebKit/Source/core/dom/Element.cpp:1707:13\n #17 0x7fb5e3542c56 in blink::Document::updateStyle() third_party/WebKit/Source/core/dom/Document.cpp:1802:13\n #18 0x7fb5e352802d in blink::Document::updateLayoutTree() third_party/WebKit/Source/core/dom/Document.cpp:1736:5\n #19 0x7fb5e5303a30 in blink::FrameView::updateStyleAndLayoutIfNeededRecursiveInternal() third_party/WebKit/Source/core/frame/FrameView.cpp:2587:5\n", "sanitizer": "MemorySanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/msan_uninitialized_value.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@msan_uninitialized_value.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/msan_uninitialized_value.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@msan_uninitialized_value.txt.snap index 8cdd42a57e..ac1eecdf1f 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/msan_uninitialized_value.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@msan_uninitialized_value.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/msan_uninitialized_value.txt +--- { "text": "[18334:18334:0303/172027:ERROR:gl_implementation_osmesa.cc(22)] Failed to load /mnt/scratch0/clusterfuzz/bot/builds/linux_msan_chrome_ipc/custom/libosmesa.so: /mnt/scratch0/clusterfuzz/bot/builds/linux_msan_chrome_ipc/custom/libosmesa.so: cannot open shared object file: No such file or directory\n[18334:18334:0303/172027:ERROR:gpu_child_thread.cc(161)] Exiting GPU process due to errors during initialization\n[18306:18306:0303/172030:ERROR:extension_downloader.cc(695)] Invalid URL: for extension nmmhkkegccagdldgiimedpiccmgmieda\nUninitialized bytes in __interceptor_write at offset 24 inside [0x60c000059e20, 28)\n==18306== WARNING: MemorySanitizer: use-of-uninitialized-value\n #0 0x7fcf2c332fe2 in content::BrowserMessageFilter::Send(IPC::Message*) content/public/browser/browser_message_filter.cc:144:12\n #1 0x7fcf1efb30a4 in ChromeNetBenchmarkingMessageFilter::OnMessageReceived(IPC::Message const&) ipc/ipc_message_utils.h:904:5\n #2 0x7fcf2c334dc1 in content::BrowserMessageFilter::Internal::OnMessageReceived(IPC::Message const&) content/public/browser/browser_message_filter.cc:89:15\n #3 0x7fcf227e6cb1 in IPC::MessageFilterRouter::TryFilters(IPC::Message const&) ipc/message_filter_router.cc:18:9\n #4 0x7fcf227b32ab in IPC::ChannelProxy::Context::TryFilters(IPC::Message const&) ipc/ipc_channel_proxy.cc:75:7\n #5 0x7fcf227b374c in IPC::ChannelProxy::Context::OnMessageReceived(IPC::Message const&) ipc/ipc_channel_proxy.cc:92:8\n #6 0x7fcf227c0431 in IPC::internal::ChannelReader::DispatchInputData(char const*, int) ipc/ipc_channel_reader.cc:96:9\n #7 0x7fcf227bf95b in IPC::internal::ChannelReader::ProcessIncomingMessages() ipc/ipc_channel_reader.cc:32:10\n #8 0x7fcf227a4f4e in IPC::ChannelPosix::OnFileCanReadWithoutBlocking(int) ipc/ipc_channel_posix.cc:708:10\n\n Uninitialized value was stored to memory at\n #0 0x7fcf20a113d4 in void Pickle::WriteBytesStatic<4ul>(void const*) base/pickle.cc:368:3\n #1 0x7fcf1efb303a in ChromeNetBenchmarkingMessageFilter::OnMessageReceived(IPC::Message const&) base/pickle.h:293:5\n #2 0x7fcf2c334dc1 in content::BrowserMessageFilter::Internal::OnMessageReceived(IPC::Message const&) content/public/browser/browser_message_filter.cc:89:15\n #3 0x7fcf227e6cb1 in IPC::MessageFilterRouter::TryFilters(IPC::Message const&) ipc/message_filter_router.cc:18:9\n #4 0x7fcf227b32ab in IPC::ChannelProxy::Context::TryFilters(IPC::Message const&) ipc/ipc_channel_proxy.cc:75:7\n #5 0x7fcf227b374c in IPC::ChannelProxy::Context::OnMessageReceived(IPC::Message const&) ipc/ipc_channel_proxy.cc:92:8\n #6 0x7fcf227c0431 in IPC::internal::ChannelReader::DispatchInputData(char const*, int) ipc/ipc_channel_reader.cc:96:9\n #7 0x7fcf227bf95b in IPC::internal::ChannelReader::ProcessIncomingMessages() ipc/ipc_channel_reader.cc:32:10\n #8 0x7fcf227a4f4e in IPC::ChannelPosix::OnFileCanReadWithoutBlocking(int) ipc/ipc_channel_posix.cc:708:10\n #9 0x7fcf2093cafc in base::MessagePumpLibevent::OnLibeventNotification(int, short, void*) base/message_loop/message_pump_libevent.cc:99:3\n #10 0x7fcf20ba2548 in event_base_loop third_party/libevent/event.c:373:4\n #11 0x7fcf2093dc01 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_libevent.cc:236:5\n #12 0x7fcf20a2deb6 in base::RunLoop::Run() base/run_loop.cc:55:3\n #13 0x7fcf209d7164 in base::MessageLoop::Run() base/message_loop/message_loop.cc:307:3\n #14 0x7fcf2c3e507a in content::BrowserThreadImpl::IOThreadRun(base::MessageLoop*) content/browser/browser_thread_impl.cc:218:3\n #15 0x7fcf2c3e5576 in content::BrowserThreadImpl::Run(base::MessageLoop*) content/browser/browser_thread_impl.cc:253:14\n #16 0x7fcf20adfddf in base::Thread::ThreadMain() base/threading/thread.cc:228:5\n #17 0x7fcf20aceb15 in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:80:3\n #18 0x7fcf15e1e181 in start_thread /build/buildd/eglibc-2.19/nptl/pthread_create.c:312\n\n Uninitialized value was stored to memory at\n #0 0x7fcf1efb3186 in ChromeNetBenchmarkingMessageFilter::OnMessageReceived(IPC::Message const&) ipc/ipc_message_utils.h:145:5\n #1 0x7fcf2c334dc1 in content::BrowserMessageFilter::Internal::OnMessageReceived(IPC::Message const&) content/public/browser/browser_message_filter.cc:89:15\n #2 0x7fcf227e6cb1 in IPC::MessageFilterRouter::TryFilters(IPC::Message const&) ipc/message_filter_router.cc:18:9\n #3 0x7fcf227b32ab in IPC::ChannelProxy::Context::TryFilters(IPC::Message const&) ipc/ipc_channel_proxy.cc:75:7\n #4 0x7fcf227b374c in IPC::ChannelProxy::Context::OnMessageReceived(IPC::Message const&) ipc/ipc_channel_proxy.cc:92:8\n #5 0x7fcf227c0431 in IPC::internal::ChannelReader::DispatchInputData(char const*, int) ipc/ipc_channel_reader.cc:96:9\n #6 0x7fcf227bf95b in IPC::internal::ChannelReader::ProcessIncomingMessages() ipc/ipc_channel_reader.cc:32:10\n #7 0x7fcf227a4f4e in IPC::ChannelPosix::OnFileCanReadWithoutBlocking(int) ipc/ipc_channel_posix.cc:708:10\n #8 0x7fcf2093cafc in base::MessagePumpLibevent::OnLibeventNotification(int, short, void*) base/message_loop/message_pump_libevent.cc:99:3\n #9 0x7fcf20ba2548 in event_base_loop third_party/libevent/event.c:373:4\n #10 0x7fcf2093dc01 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_libevent.cc:236:5\n #11 0x7fcf20a2deb6 in base::RunLoop::Run() base/run_loop.cc:55:3\n #12 0x7fcf209d7164 in base::MessageLoop::Run() base/message_loop/message_loop.cc:307:3\n #13 0x7fcf2c3e507a in content::BrowserThreadImpl::IOThreadRun(base::MessageLoop*) content/browser/browser_thread_impl.cc:218:3\n #14 0x7fcf2c3e5576 in content::BrowserThreadImpl::Run(base::MessageLoop*) content/browser/browser_thread_impl.cc:253:14\n #15 0x7fcf20adfddf in base::Thread::ThreadMain() base/threading/thread.cc:228:5\n #16 0x7fcf20aceb15 in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:80:3\n #17 0x7fcf15e1e181 in start_thread /build/buildd/eglibc-2.19/nptl/pthread_create.c:312\n\n invalid origin id(0)\nSUMMARY: MemorySanitizer: use-of-uninitialized-value ??:0 ??\nExiting\n", "sanitizer": "MemorySanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/oom2.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@oom2.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/oom2.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@oom2.txt.snap index 3c47d1f98b..d582be92ab 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/oom2.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@oom2.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/oom2.txt +--- { "text": "==25416==WARNING: AddressSanitizer failed to allocate 0x9a9a9a9a000000 bytes\n=================================================================\n==25416==ERROR: AddressSanitizer: allocator is out of memory trying to allocate 0x9a9a9a9a000000 bytes\n #0 0x10c80e0c2 in __sanitizer_finish_switch_fiber\n #1 0x10b46ada9 in __libcpp_allocate /b/build/slave/Libfuzzer_Upload_Mac_ASan/build/src/third_party/llvm-build/Release+Asserts/include/c++/v1/new:259:10\n #2 0x10b46ada9 in allocate /b/build/slave/Libfuzzer_Upload_Mac_ASan/build/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:1799\n #3 0x10b46ada9 in allocate /b/build/slave/Libfuzzer_Upload_Mac_ASan/build/src/third_party/llvm-build/Release+Asserts/include/c++/v1/memory:1548\n #4 0x10b46ada9 in std::__1::__split_buffer&>::__split_buffer(unsigned long, unsigned long, std::__1::allocator&) /b/build/slave/Libfuzzer_Upload_Mac_ASan/build/src/third_party/llvm-build/Release+Asserts/include/c++/v1/__split_buffer:311\n #5 0x10b46a6b8 in std::__1::vector >::__append(unsigned long) /b/build/slave/Libfuzzer_Upload_Mac_ASan/build/src/third_party/llvm-build/Release+Asserts/include/c++/v1/vector:1047:53\n #6 0x10b4648fa in safe_browsing::dmg::HFSForkReadStream::Read(unsigned char*, unsigned long, unsigned long*) /b/build/slave/Libfuzzer_Upload_Mac_ASan/build/src/chrome/utility/safe_browsing/mac/hfs.cc:381:28\n #7 0x10b46d626 in safe_browsing::dmg::ReadStream::ReadExact(unsigned char*, unsigned long) /b/build/slave/Libfuzzer_Upload_Mac_ASan/build/src/chrome/utility/safe_browsing/mac/read_stream.cc:20:10\n #8 0x10b463f37 in safe_browsing::dmg::HFSBTreeIterator::Init(safe_browsing::dmg::ReadStream*) /b/build/slave/Libfuzzer_Upload_Mac_ASan/build/src/chrome/utility/safe_browsing/mac/hfs.cc:486:17\n #9 0x10b4610bd in LLVMFuzzerTestOneInput /b/build/slave/Libfuzzer_Upload_Mac_ASan/build/src/chrome/utility/safe_browsing/mac/hfs_fuzzer.cc:19:21\n #10 0x10b48cdeb in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /b/build/slave/Libfuzzer_Upload_Mac_ASan/build/src/third_party/libFuzzer/src/FuzzerLoop.cpp:515:13\n #11 0x10b46ee85 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /b/build/slave/Libfuzzer_Upload_Mac_ASan/build/src/third_party/libFuzzer/src/FuzzerDriver.cpp:280:6\n #12 0x10b4746c4 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /b/build/slave/Libfuzzer_Upload_Mac_ASan/build/src/third_party/libFuzzer/src/FuzzerDriver.cpp:703:9\n #13 0x10b49d681 in main /b/build/slave/Libfuzzer_Upload_Mac_ASan/build/src/third_party/libFuzzer/src/FuzzerMain.cpp:20:10\n #14 0x7fff9af635ac in start\n\n==25416==HINT: if you don't care about these errors you may set ASAN_OPTIONS=allocator_may_return_null=1\nSUMMARY: AddressSanitizer: out-of-memory (/b/clusterfuzz/bot/builds/chromium-browser-libfuzzer_mac-release-asan_53aadfd01f0d682b1d94abd5ad7af8a887b5763e/revisions/libfuzzer-mac-release-550895/libclang_rt.asan_osx_dynamic.dylib:x86_64+0x650c2)\n==25416==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/oom3.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@oom3.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/oom3.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@oom3.txt.snap index c7ec70ee55..8bd090d353 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/oom3.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@oom3.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/oom3.txt +--- { "text": "==1246==ERROR: AddressSanitizer: requested allocation size 0x285be9c758f75400 (0x285be9c758f76400 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0 (chrome))\n #0 0x55db32469933 in __interceptor_malloc third_party/llvm/compiler-rt/lib/asan/asan_malloc_linux.cc:88:3\n #1 0x55db44461003 in PartitionAllocGenericFlags base/allocator/partition_allocator/partition_alloc.h:947:18\n #2 0x55db44461003 in AllocateMemoryWithFlags third_party/blink/renderer/platform/wtf/typed_arrays/array_buffer_contents.cc:111\n #3 0x55db44461003 in WTF::ArrayBufferContents::AllocateMemoryOrNull(unsigned long, WTF::ArrayBufferContents::InitializationPolicy) third_party/blink/renderer/platform/wtf/typed_arrays/array_buffer_contents.cc:121\n #4 0x55db38743024 in v8::internal::JSArrayBuffer::SetupAllocatingData(v8::internal::Handle, v8::internal::Isolate*, unsigned long, bool, v8::internal::SharedFlag) v8/src/objects.cc\n #5 0x55db377b1006 in v8::internal::(anonymous namespace)::ConstructBuffer(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, bool) v8/src/builtins/builtins-arraybuffer.cc:43:8\n #6 0x55db377ac88a in v8::internal::Builtin_Impl_ArrayBufferConstructor(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-arraybuffer.cc:76:12\n #7 0x7ecb7cb042dc ()\n #8 0x7ecb7cb0f1a4 ()\n #9 0x7ecb7cb8afcd ()\n #10 0x7ecb7cb120a8 ()\n #11 0x7ecb7cb107d4 ()\n #12 0x7ecb7cb09ce0 ()\n #13 0x55db38162ee4 in Call v8/src/simulator.h:113:12\n #14 0x55db38162ee4 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle, v8::internal::Execution::MessageHandling, v8::internal::Execution::Target) v8/src/execution.cc:155\n #15 0x55db38162272 in CallInternal v8/src/execution.cc:191:10\n #16 0x55db38162272 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:202\n #17 0x55db375e0a91 in v8::Script::Run(v8::Local) v8/src/api.cc:2160:7\n #18 0x55db4494ab37 in blink::V8ScriptRunner::RunCompiledScript(v8::Isolate*, v8::Local, blink::ExecutionContext*) third_party/blink/renderer/bindings/core/v8/v8_script_runner.cc:474:22\n #19 0x55db458d4f27 in blink::ScriptController::ExecuteScriptAndReturnValue(v8::Local, blink::ScriptSourceCode const&, blink::KURL const&, blink::ScriptFetchOptions const&, blink::AccessControlStatus) third_party/blink/renderer/bindings/core/v8/script_controller.cc:148:20\n #20 0x55db458d7696 in blink::ScriptController::EvaluateScriptInMainWorld(blink::ScriptSourceCode const&, blink::KURL const&, blink::ScriptFetchOptions const&, blink::AccessControlStatus, blink::ScriptController::ExecuteScriptPolicy) third_party/blink/renderer/bindings/core/v8/script_controller.cc:349:33\n #21 0x55db458d807f in blink::ScriptController::ExecuteScriptInMainWorld(blink::ScriptSourceCode const&, blink::KURL const&, blink::ScriptFetchOptions const&, blink::AccessControlStatus) third_party/blink/renderer/bindings/core/v8/script_controller.cc:314:3\n #22 0x55db48301660 in blink::ScriptLoader::ExecuteScriptBlock(blink::PendingScript*, blink::KURL const&) third_party/blink/renderer/core/script/script_loader.cc:890:13\n #23 0x55db482fc40c in blink::ScriptLoader::PrepareScript(WTF::TextPosition const&, blink::ScriptLoader::LegacyTypeSupport) third_party/blink/renderer/core/script/script_loader.cc:705:3\n #24 0x55db482b69c1 in blink::HTMLParserScriptRunner::ProcessScriptElementInternal(blink::Element*, WTF::TextPosition const&) third_party/blink/renderer/core/script/html_parser_script_runner.cc:521:20\n #25 0x55db482b6278 in blink::HTMLParserScriptRunner::ProcessScriptElement(blink::Element*, WTF::TextPosition const&) third_party/blink/renderer/core/script/html_parser_script_runner.cc:300:3\n #26 0x55db46bbdbdf in RunScriptsForPausedTreeBuilder third_party/blink/renderer/core/html/parser/html_document_parser.cc:285:21\n #27 0x55db46bbdbdf in blink::HTMLDocumentParser::ProcessTokenizedChunkFromBackgroundParser(std::__1::unique_ptr >) third_party/blink/renderer/core/html/parser/html_document_parser.cc:550\n #28 0x55db46bb8203 in blink::HTMLDocumentParser::PumpPendingSpeculations() third_party/blink/renderer/core/html/parser/html_document_parser.cc:608:9\n #29 0x55db4485f29c in Run base/callback.h:96:12\n #30 0x55db4485f29c in blink::TaskHandle::Runner::Run(blink::TaskHandle const&) third_party/blink/renderer/platform/web_task_runner.cc:75\n #31 0x55db3a7f9e19 in Run base/callback.h:96:12\n #32 0x55db3a7f9e19 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101\n #33 0x55db394d11da in blink::scheduler::internal::ThreadControllerImpl::DoWork(blink::scheduler::internal::SequencedTaskSource::WorkType) third_party/blink/renderer/platform/scheduler/base/thread_controller_impl.cc:162:21\n #34 0x55db3a7f9e19 in Run base/callback.h:96:12\n #35 0x55db3a7f9e19 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101\n #36 0x55db3a85ee09 in base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:319:25\n #37 0x55db3a8602cf in DeferOrRunPendingTask base/message_loop/message_loop.cc:329:5\n #38 0x55db3a8602cf in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:373\n==1246==HINT: if you don't care about these errors you may set ASAN_OPTIONS=allocator_may_return_null=1\nSUMMARY: AddressSanitizer: allocation-size-too-big /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/asan_malloc_linux.cc:88:3 in __interceptor_malloc\n==1246==ABORTING\n[0422/074534.295828:ERROR:nacl_helper_linux.cc(310)] NaCl helper process running without a sandbox!\nMost likely you need to configure your SUID sandbox correctly\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/oom4.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@oom4.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/oom4.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@oom4.txt.snap index 5c7bf8ceb8..dfdf0aac47 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/oom4.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@oom4.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/oom4.txt +--- { "text": "Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/2865ac1ef97c5b82fcbb58bb6e4880f5d2cddf24a003c886d7ac6510dcfuzz-0\n==7320==ERROR: MemorySanitizer: requested allocation size 0x3ff00000000 exceeds maximum supported size of 0x200000000\n#0 0x35c73d in __interceptor_malloc third_party/llvm/compiler-rt/lib/msan/msan_interceptors.cc:907:3\n#1 0x5f2af9 in opj_j2k_update_image_data third_party/pdfium/third_party/libopenjpeg20/j2k.c:9184:50\n#2 0x5f0a40 in opj_j2k_decode_tiles third_party/pdfium/third_party/libopenjpeg20/j2k.c:10734:15\n#3 0x5c4230 in opj_j2k_exec third_party/pdfium/third_party/libopenjpeg20/j2k.c:8090:33\n#4 0x5d5991 in opj_j2k_decode third_party/pdfium/third_party/libopenjpeg20/j2k.c:11019:11\n#5 0x5c1a9d in opj_decode third_party/pdfium/third_party/libopenjpeg20/openjpeg.c:483:16\n#6 0x5b2b76 in CJPX_Decoder::Init(unsigned char const*, unsigned int) third_party/pdfium/core/fxcodec/codec/fx_codec_jpx_opj.cpp:526:11\n#7 0x5b5c9c in CCodec_JpxModule::CreateDecoder(unsigned char const*, unsigned int, CPDF_ColorSpace*) third_party/pdfium/core/fxcodec/codec/fx_codec_jpx_opj.cpp:652:19\n#8 0x3aa1fb in LLVMFuzzerTestOneInput third_party/pdfium/testing/fuzzers/pdf_jpx_fuzzer.cc:23:16\n#9 0x3eac69 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:526:13\n#10 0x3bc9d0 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:280:6\n#11 0x3c7634 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:707:9\n#12 0x40a250 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10\n#13 0x7f41340d382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291\n==7320==HINT: if you don't care about these errors you may set =allocator_may_return_null=1\nSUMMARY: MemorySanitizer: allocation-size-too-big (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-msan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-569934/pdf_jpx_fuzzer+0x35c73d)\n", "sanitizer": "MemorySanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/python_unhandled_exception.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@python_unhandled_exception.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/python_unhandled_exception.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@python_unhandled_exception.txt.snap index 6252534735..48bb1b36f3 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/python_unhandled_exception.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@python_unhandled_exception.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/python_unhandled_exception.txt +--- { "text": "random output from the fuzzee\nan other line of output\nand a third one, for good measure!\n\n === Uncaught Python exception: ===\nFuzzError: Traceback (most recent call last):\n File \"/python/fuzzer.py\", line 69, in Wrapper\n ret = target(data)\n File \"/fuzzers/fuzz_tar.py\", line 24, in TestOneInput\n with tarfile.open(path) as mytar:\n File \"/tarfile.py\", line 1571, in open\n return func(name, \"r\", fileobj, **kwargs)\n File \"/tarfile.py\", line 1643, in gzopen\n t = cls.taropen(name, mode, fileobj, **kwargs)\n File \"/tarfile.py\", line 1619, in taropen\n return cls(name, mode, fileobj, **kwargs)\n File \"/tarfile.py\", line 1482, in __init__\n self.firstmember = self.next()\n File \"/tarfile.py\", line 2297, in next\n tarinfo = self.tarinfo.fromtarfile(self)\n File \"/tarfile.py\", line 1092, in fromtarfile\n buf = tarfile.fileobj.read(BLOCKSIZE)\n File \"/gzip.py\", line 276, in read\n return self._buffer.read(size)\n File \"/_compression.py\", line 68, in readinto\n data = self.read(len(byte_view))\n File \"/gzip.py\", line 463, in read\n if not self._read_gzip_header():\n File \"/gzip.py\", line 421, in _read_gzip_header\n self._read_exact(extra_len)\n File \"/gzip.py\", line 400, in _read_exact\n raise EOFError(\"Compressed file ended before the \"\nEOFError: Compressed file ended before the end-of-stream marker was reached\n\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==216753==ERROR: AddressSanitizer: ABRT on unknown address 0x97cb400034eb1 (pc 0x7efc3e145849 bp 0x7ffc9776f1d0 sp 0x7ffc9776f1c8 T0)\n #0 0x7efc3e145849 in raise (/usr/grte/v4/lib64/libpthread.so.0+0xf849)\n #1 0x5629075d5730 in LLVMFuzzerTestOneInput security/fuzzing/blaze/python_fuzzer_impl.cc:111:5\n #2 0x562907ad7a56 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/llvm/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15\n #3 0x562907ad7125 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) third_party/llvm/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:470:3\n #4 0x562907ad92b4 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__u::vector >&) third_party/llvm/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:765:7\n #5 0x562907ad95f9 in fuzzer::Fuzzer::Loop(std::__u::vector >&) third_party/llvm/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:792:3\n #6 0x562907ac8c48 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/llvm/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:832:6\n #7 0x562907abb502 in main third_party/llvm/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10\n #8 0x7efc3df75bbc in __libc_start_main (/usr/grte/v4/lib64/libc.so.6+0x38bbc)\n #9 0x5629064d47e8 in _start /usr/grte/v4/debug-src/src/csu/../sysdeps/x86_64/start.S:108\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/usr/grte/v4/lib64/libpthread.so.0+0xf849) in raise\n==216753==ABORTING\nMS: 0 ; base unit: 0000000000000000000000000000000000000000\nartifact_prefix='./'; Test unit written to ./crash-fa60b4aff2c5e904bf41b420614260d5d11e623b\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/regress_double_unknown.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@regress_double_unknown.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/regress_double_unknown.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@regress_double_unknown.txt.snap index 9892fa1b70..35b0d719ee 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/regress_double_unknown.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@regress_double_unknown.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/regress_double_unknown.txt +--- { "text": "[9613:3079:0329/114239:ERROR:render_widget_host_view_mac.mm(812)] Failed to create display link.\nASAN:DEADLYSIGNAL\n=================================================================\n==9632==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000530 (pc 0x00010fedad61 bp 0x7fff5b22a9c0 sp 0x7fff5b22a920 T0)\n==9632==The signal is caused by a UNKNOWN memory access.\n==9632==Hint: address points to the zero page.\nSCARINESS: 10 (null-deref)\n #0 0x10fedad60 in IgnoringPendingStylesheet third_party/WebKit/Source/core/dom/StyleEngine.h:73:44\n #1 0x10fedad60 in IgnoringPendingStylesheet third_party/WebKit/Source/core/dom/StyleEngine.h:74\n #2 0x10fedad60 in blink::Document::updateLayoutTreeIgnorePendingStylesheets() third_party/WebKit/Source/core/dom/Document.cpp:2022\n #3 0x10fedb4e1 in blink::Document::updateLayoutIgnorePendingStylesheets(blink::Document::RunPostLayoutTasks) third_party/WebKit/Source/core/dom/Document.cpp:2048:5\n #4 0x110d7f3dc in blink::TextIteratorAlgorithm >::TextIteratorAlgorithm(blink::PositionTemplate > const&, blink::PositionTemplate > const&, unsigned int) third_party/WebKit/Source/core/editing/iterators/TextIterator.cpp:151:5\n #5 0x110d87d0c in TextIteratorAlgorithm third_party/WebKit/Source/core/editing/iterators/TextIterator.cpp:146:1\n #6 0x110d87d0c in blink::TextIteratorAlgorithm >::rangeLength(blink::PositionTemplate > const&, blink::PositionTemplate > const&, bool) third_party/WebKit/Source/core/editing/iterators/TextIterator.cpp:1097\n #7 0x110df9c76 in blink::TextCheckingParagraph::checkingStart() const third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp:206:27\n #8 0x110df9781 in isRangeEmpty third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.h:73:40\n #9 0x110df9781 in blink::TextCheckingParagraph::isEmpty() const third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp:182\n #10 0x110df1a64 in blink::SpellChecker::chunkAndMarkAllMisspellingsAndBadGrammar(unsigned int, blink::TextCheckingParagraph const&) third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp:531:9\n #11 0x110df016b in blink::SpellChecker::markAllMisspellingsAndBadGrammarInRanges(unsigned int, blink::EphemeralRangeTemplate > const&, blink::EphemeralRangeTemplate > const&) third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp:498:5\n #12 0x110def6e1 in blink::SpellChecker::markMisspellingsAndBadGrammar(blink::VisibleSelectionTemplate > const&, bool, blink::VisibleSelectionTemplate > const&) third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp:659:9\n #13 0x110cfa684 in blink::CompositeEditCommand::moveParagraphs(blink::VisiblePositionTemplate > const&, blink::VisiblePositionTemplate > const&, blink::VisiblePositionTemplate > const&, blink::EditingState*, bool, bool, blink::Node*) third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp:1349:5\n #14 0x110d0e255 in blink::DeleteSelectionCommand::mergeParagraphs(blink::EditingState*) third_party/WebKit/Source/core/editing/commands/DeleteSelectionCommand.cpp:711:5\n #15 0x110d1035c in blink::DeleteSelectionCommand::doApply(blink::EditingState*) third_party/WebKit/Source/core/editing/commands/DeleteSelectionCommand.cpp:894:5\n #16 0x110ceb1d7 in blink::CompositeEditCommand::applyCommandToComposite(WTF::RawPtr, blink::EditingState*) third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp:255:5\n #17 0x110cf36ad in blink::CompositeEditCommand::deleteSelection(blink::VisibleSelectionTemplate > const&, blink::EditingState*, bool, bool, bool, bool) third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp:627:9\n #18 0x110d68667 in blink::TypingCommand::forwardDeleteKeyPressed(blink::TextGranularity, bool, blink::EditingState*) third_party/WebKit/Source/core/editing/commands/TypingCommand.cpp:671:5\n #19 0x110d6c75e in blink::TypingCommand::doApply(blink::EditingState*) third_party/WebKit/Source/core/editing/commands/TypingCommand.cpp:275:9\n #20 0x110ceac56 in blink::CompositeEditCommand::apply() third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp:208:9\n #21 0x110d6772a in blink::TypingCommand::forwardDeleteKeyPressed(blink::Document&, blink::EditingState*, unsigned int, blink::TextGranularity) third_party/WebKit/Source/core/editing/commands/TypingCommand.cpp:122:5\n #22 0x110d18f79 in blink::executeForwardDelete(blink::LocalFrame&, blink::Event*, blink::EditorCommandSource, WTF::String const&) third_party/WebKit/Source/core/editing/commands/EditorCommand.cpp:501:9\n #23 0x110d14533 in blink::Editor::Command::execute(WTF::String const&, blink::Event*) const third_party/WebKit/Source/core/editing/commands/EditorCommand.cpp:1785:12\n #24 0x10ff02a0b in blink::Document::execCommand(WTF::String const&, bool, WTF::String const&, blink::ExceptionState&) third_party/WebKit/Source/core/dom/Document.cpp:4549:12\n #25 0x112334b32 in execCommandMethod out/Release/gen/blink/bindings/core/v8/V8Document.cpp:4121:19\n #26 0x112334b32 in blink::DocumentV8Internal::execCommandMethodCallback(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8Document.cpp:4131\n #27 0x10d67c422 in v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo const&)) v8/src/api-arguments.cc:16:3\n #28 0x10d72340a in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>) v8/src/builtins.cc:3949:29\n #29 0x10d74c293 in Builtin_Impl_HandleApiCall v8/src/builtins.cc:3967:3\n #30 0x10d74c293 in v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*) v8/src/builtins.cc:3964\n #25 0x126306646 ()\n #26 0x1264864e0 ()\n #27 0x126309814 ()\n #28 0x12648c8d1 ()\n #29 0x126309814 ()\n #30 0x1264062a8 ()\n #31 0x126339582 ()\n #32 0x126326a0e ()\n #31 0x10df077b9 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle) v8/src/execution.cc:97:13\n #32 0x10df06e7a in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:163:10\n #33 0x10d631d67 in v8::Function::Call(v8::Local, v8::Local, int, v8::Local*) v8/src/api.cc:4481:7\n #34 0x111d9b09d in blink::V8ScriptRunner::callFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp:465:40\n #35 0x111ce62c1 in blink::ScheduledAction::execute(blink::LocalFrame*) third_party/WebKit/Source/bindings/core/v8/ScheduledAction.cpp:119:9\n #36 0x110eabb39 in blink::DOMTimer::fired() third_party/WebKit/Source/core/frame/DOMTimer.cpp:134:5\n #37 0x10cd3e4bd in blink::TimerBase::runInternal() third_party/WebKit/Source/platform/Timer.cpp:136:5\n #38 0x10cd3e852 in blink::TimerBase::CancellableTimerTask::run() third_party/WebKit/Source/platform/Timer.h:113:17\n #39 0x11484e25f in Run > > base/bind_internal.h:159:12\n #40 0x11484e25f in MakeItSo > > base/bind_internal.h:311\n #41 0x11484e25f in base::internal::Invoker, base::internal::BindState >)>, void (std::__1::unique_ptr >), base::internal::PassedWrapper > > >, base::internal::InvokeHelper >)> >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:362\n #42 0x108df863c in Run base/callback.h:397:12\n #43 0x108df863c in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51\n #44 0x114836104 in scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(scheduler::internal::WorkQueue*, scheduler::internal::TaskQueueImpl::Task*) components/scheduler/base/task_queue_manager.cc:288:3\n #45 0x114832e08 in scheduler::TaskQueueManager::DoWork(base::TimeTicks, bool) components/scheduler/base/task_queue_manager.cc:200:13\n #46 0x11483951a in Run base/bind_internal.h:181:12\n #47 0x11483951a in MakeItSo, const base::TimeTicks &, const bool &> base/bind_internal.h:324\n #48 0x11483951a in base::internal::Invoker, base::internal::BindState, void (scheduler::TaskQueueManager*, base::TimeTicks, bool), base::WeakPtr, base::TimeTicks&, bool>, base::internal::InvokeHelper >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:362\n #49 0x108df863c in Run base/callback.h:397:12\n #50 0x108df863c in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51\n #51 0x108e635c3 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:476:3\n #52 0x108e63f5c in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:485:5\n #53 0x108e64e37 in base::MessageLoop::DoDelayedWork(base::TimeTicks*) base/message_loop/message_loop.cc:635:10\n #54 0x108dd38c9 in base::MessagePumpCFRunLoopBase::RunWork() base/message_loop/message_pump_mac.mm:334:3\n #55 0x108e45739 in base::mac::CallWithEHFrame(void () block_pointer)\n #56 0x108dd1cf6 in base::MessagePumpCFRunLoopBase::RunWorkSource(void*) base/message_loop/message_pump_mac.mm:306:3\n #57 0x7fff8c7625b0 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__\n #58 0x7fff8c753c61 in __CFRunLoopDoSources0\n #59 0x7fff8c7533ee in __CFRunLoopRun\n #60 0x7fff8c752e74 in CFRunLoopRunSpecific\n #61 0x7fff88a620fb in -[NSRunLoop(NSRunLoop) runMode:beforeDate:]\n #62 0x108dd4d53 in base::MessagePumpNSRunLoop::DoRun(base::MessagePump::Delegate*) base/message_loop/message_pump_mac.mm:608:5\n #63 0x108dd315b in base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_mac.mm:238:3\n #64 0x108eabf28 in base::RunLoop::Run() base/run_loop.cc:35:3\n #65 0x108e61b64 in base::MessageLoop::Run() base/message_loop/message_loop.cc:293:3\n #66 0x116a747f2 in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:219:7\n #67 0x108d121c0 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:754:12\n #68 0x108d103ad in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #69 0x107e07faf in ChromeMain chrome/app/chrome_main.cc:84:12\n #70 0x1049cf99f in main chrome/app/chrome_exe_main_mac.c:87:8\n #71 0x1049cf563 in start\n #68 0x17 ()\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV (/b/clusterfuzz/bot/builds/chrome-test-builds_media_mac-release_e6940505d6c387d688e04a7feeb7e2019c3efe81/revisions/asan-mac-release-383194/Chromium.app/Contents/Versions/51.0.2690.0/Chromium Framework.framework/Chromium Framework+0x80d6d60)\n==9632==ABORTING\nReceived signal 6\n[end of stack trace]\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/rust_assert.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@rust_assert.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/rust_assert.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@rust_assert.txt.snap index ddd9d1b8ef..49d0072f1d 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/rust_assert.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@rust_assert.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/rust_assert.txt +--- { "text": "Running: /9d6d91a8df092e704e2790e8a6818b055e6b4b0d3255bfef95601890afd80709\nthread '' panicked at 'Error: could not find an available port', config/src/utils.rs:27:5\nnote: run with `RUST_BACKTRACE=1` environment variable to display a backtrace\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7f278061b428 bp 0x7ffe39ceeed0 sp 0x7ffe39ceed78 T0)\n #0 0x7f278061b427 in gsignal /build/glibc-LK5gWL/glibc-2.23/signal/../sysdeps/unix/sysv/linux/raise.c:54\n #1 0x7f278061d029 in abort /build/glibc-LK5gWL/glibc-2.23/stdlib/abort.c:89\n #2 0x55866ec70586 in std::sys::unix::abort_internal::h3e3f989126541ea9 (.llvm.14040283905672493915) /rustc/b8cedc00407a4c56a3bda1ed605c6fc166655447/src/libstd/sys/unix/mod.rs:165:4\n #3 0x55866ec5ea85 in std::process::abort::h1cec5cf8ad2f945d /rustc/b8cedc00407a4c56a3bda1ed605c6fc166655447/src/libstd/process.rs:1609:13\n #4 0x558668255fae in libfuzzer_sys::initialize::_$u7b$$u7b$closure$u7d$$u7d$::h31ff8ab17e93ba40 /rust/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.3.2/src/lib.rs:51:8\n #5 0x55866ec63af5 in std::panicking::rust_panic_with_hook::hb7ad5693188bdb00 /rustc/b8cedc00407a4c56a3bda1ed605c6fc166655447/src/libstd/panicking.rs:476:16\n #6 0x5586682ede81 in std::panicking::begin_panic::h2194e36e9d0a3237 /rustc/b8cedc00407a4c56a3bda1ed605c6fc166655447/src/libstd/panicking.rs:399:4\n #7 0x55866847004f in libra_config::utils::get_available_port::h7d7baacfb554bae8 libra/config/src/utils.rs:27:4\n #8 0x558668cd1fbd in libra_json_rpc::fuzzing::fuzzer::hde487212e06dd4fd libra/json-rpc/src/fuzzing.rs:45:15\n #9 0x5586679065f3 in rust_fuzzer_test_input libra/testsuite/libra-fuzzer/fuzz/google-oss-fuzz/fuzzer_builder.rs:14:4\n #10 0x55866cbe9e86 in __rust_maybe_catch_panic /rustc/b8cedc00407a4c56a3bda1ed605c6fc166655447/src/libpanic_unwind/lib.rs:86:7\n #11 0x558668255b41 in std::panicking::try::h8d8e3e4107771fb3 /rustc/b8cedc00407a4c56a3bda1ed605c6fc166655447/src/libstd/panicking.rs:281:12\n #12 0x558668255b41 in std::panic::catch_unwind::he4d9e2a6e9cdb201 /rustc/b8cedc00407a4c56a3bda1ed605c6fc166655447/src/libstd/panic.rs:394:13\n #13 0x558668255b41 in LLVMFuzzerTestOneInput /rust/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.3.2/src/lib.rs:25:21\n #14 0x5586713bea16 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:556:15\n #15 0x558671377e1f in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:292:6\n #16 0x558671385a82 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:774:9\n #17 0x558671377467 in main /src/libfuzzer/FuzzerMain.cpp:19:10\n #18 0x7f278060682f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291\n #19 0x558665a90af8 in _start (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_libra_261a3974d6fe02088847c66c42b86704d2cb5fde/revisions/json_rpc_service+0x4331af8)\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT /build/glibc-LK5gWL/glibc-2.23/signal/../sysdeps/unix/sysv/linux/raise.c:54 in gsignal\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/rust_ignores.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@rust_ignores.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/rust_ignores.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@rust_ignores.txt.snap index 07b150724f..93e3f5a538 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/rust_ignores.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@rust_ignores.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/rust_ignores.txt +--- { "text": "INFO: Running with entropic power schedule (0xFF, 100).\nINFO: Seed: 3597413507\nINFO: Loaded 1 modules (619877 inline 8-bit counters): 619877 [0x55575a64b74a, 0x55575a6e2caf),\nINFO: Loaded 1 PC tables (619877 PCs): 619877 [0x55575a6e2cb0,0x55575b058300),\n/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_wasmtime_9d7f296cb3c934976ab46f0ee760a3a07ef3344a/revisions/spectests: Running 1 inputs 100 time(s) each.\nRunning: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/c176653beef72c715138c432ebcf9db9819c383ddba3f64de5a9ba5ed7caec4f\nthread '' panicked at 'called `Result::unwrap()` on an `Err` value: failed directive on wasmtime/crates/fuzzing/../../tests/spec_testsuite/table.wast:11:1\nCaused by:\n expected module to fail to build', wasmtime/crates/fuzzing/src/oracles.rs:427:10\nnote: run with `RUST_BACKTRACE=1` environment variable to display a backtrace\n==147652== ERROR: libFuzzer: deadly signal\n #0 0x55575517a9a1 in __sanitizer_print_stack_trace /rustc/llvm/src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:86:3\n #1 0x5557592e76d8 in fuzzer::PrintStackTrace() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:5\n #2 0x5557592cad53 in fuzzer::Fuzzer::CrashCallback() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:233:3\n #3 0x7f24f76cd38f in libpthread.so.0\n #4 0x7f24f6e1a437 in raise /build/glibc-e6zv40/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54\n #5 0x7f24f6e1c039 in abort /build/glibc-e6zv40/glibc-2.23/stdlib/abort.c:89\n #6 0x555759384a49 in std::sys::unix::abort_internal::h411dc3861a5cb281 /rustc/673d0db5e393e9c64897005b470bfeb6d5aec61b/library/std/src/sys/unix/mod.rs:205:14\n #7 0x5557550f30b8 in std::process::abort::hd257d0bc0ddb140c /rustc/673d0db5e393e9c64897005b470bfeb6d5aec61b/library/std/src/process.rs:1814:5\n #8 0x55575931d25e in libfuzzer_sys::initialize::_$u7b$$u7b$closure$u7d$$u7d$::h8a22640c22e97ee8 /rust/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.0/src/lib.rs:51:9\n #9 0x555759374acf in std::panicking::rust_panic_with_hook::h70db735e3a6e70cb /rustc/673d0db5e393e9c64897005b470bfeb6d5aec61b/library/std/src/panicking.rs:595:17\n #10 0x5557593746a6 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h777c71c8e5a7e25c /rustc/673d0db5e393e9c64897005b470bfeb6d5aec61b/library/std/src/panicking.rs:497:13\n #11 0x555759370b2b in std::sys_common::backtrace::__rust_end_short_backtrace::h3e9bf30168899554 /rustc/673d0db5e393e9c64897005b470bfeb6d5aec61b/library/std/src/sys_common/backtrace.rs:141:18\n #12 0x555759374608 in rust_begin_unwind /rustc/673d0db5e393e9c64897005b470bfeb6d5aec61b/library/std/src/panicking.rs:493:5\n #13 0x5557550f5250 in core::panicking::panic_fmt::h5322a082d19786c3 /rustc/673d0db5e393e9c64897005b470bfeb6d5aec61b/library/core/src/panicking.rs:92:14\n #14 0x5557550f5142 in core::result::unwrap_failed::hbee7d9f7831678f0 /rustc/673d0db5e393e9c64897005b470bfeb6d5aec61b/library/core/src/option.rs:1329:5\n #15 0x55575538c673 in core::result::Result$LT$T$C$E$GT$::unwrap::hca82303565f74395 /rust/rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/result.rs:1037:23\n #16 0x55575538c673 in wasmtime_fuzzing::oracles::spectest::ha380505b8ea313d4 wasmtime/crates/fuzzing/src/oracles.rs:425:5\n #17 0x5557551ae1d2 in rust_fuzzer_test_input wasmtime/fuzz/fuzz_targets/spectests.rs:8:5\n #18 0x55575931d2a0 in __rust_try\n #19 0x55575931ceff in std::panicking::try::h88270102441d9383 /rust/rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:343:19\n #20 0x55575931ceff in std::panic::catch_unwind::h3f9fd73d7e24a8da /rust/rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panic.rs:431:14\n #21 0x55575931ceff in LLVMFuzzerTestOneInput /rust/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.4.0/src/lib.rs:25:22\n #22 0x5557592cc4f3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:599:15\n #23 0x5557592b6352 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6\n #24 0x5557592bc19a in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:856:9\n #25 0x5557592e7eb2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10\n #26 0x7f24f6e0583f in __libc_start_main /build/glibc-e6zv40/glibc-2.23/csu/libc-start.c:291\n #27 0x5557550f65c8 in _start\nNOTE: libFuzzer has rudimentary signal handlers.\n Combine libFuzzer with AddressSanitizer or similar for better crash reports.\nSUMMARY: libFuzzer: deadly signal\n\n", "sanitizer": "libFuzzer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/rust_oom.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@rust_oom.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/rust_oom.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@rust_oom.txt.snap index 00bfab2b8a..b0ffbf1265 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/rust_oom.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@rust_oom.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/rust_oom.txt +--- { "text": "==1==WARNING: AddressSanitizer failed to allocate 0x202020202020200c bytes\nmemory allocation of 2314885530818453516 bytes failedAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7efeaef2f428 bp 0x7ffef58fe030 sp 0x7ffef58fdd48 T0)\n #0 0x7efeaef2f427 in gsignal /build/glibc-LK5gWL/glibc-2.23/sysdeps/unix/sysv/linux/raise.c:54\n #1 0x7efeaef31029 in abort /build/glibc-LK5gWL/glibc-2.23/stdlib/abort.c:89\n #2 0x55fcb95018b6 in std::sys::unix::abort_internal::h61fc255319305c43 /rustc/3a7dfda40a3e798bf086bd58cc7e5e09deb808b5/src/libstd/sys/unix/mod.rs:167:14\n #3 0x55fcb94e9c75 in std::process::abort::hc04628a00aa4543a /rustc/3a7dfda40a3e798bf086bd58cc7e5e09deb808b5/src/libstd/process.rs:1623:5\n #4 0x55fcb94f03cd in rust_oom /rustc/3a7dfda40a3e798bf086bd58cc7e5e09deb808b5/src/libstd/alloc.rs:282:5\n #5 0x55fcb951b876 in alloc::alloc::handle_alloc_error::hf3b29e2cf0b4ae46 /rustc/3a7dfda40a3e798bf086bd58cc7e5e09deb808b5/src/liballoc/alloc.rs:307:14\n #6 0x55fcb92ea65b in alloc::raw_vec::RawVec$LT$T$C$A$GT$::reserve::hf99060ff0a84a3be /rustc/3a7dfda40a3e798bf086bd58cc7e5e09deb808b5/src/liballoc/raw_vec.rs:269:47\n #7 0x55fcb92ea65b in alloc::vec::Vec$LT$T$GT$::reserve::h76c1ff3ca24d558b /rustc/3a7dfda40a3e798bf086bd58cc7e5e09deb808b5/src/liballoc/vec.rs:500:9\n #8 0x55fcb92ea65b in mp4parse::fallible::TryVec$LT$T$GT$::reserve::h1159314b25b06f7c mp4parse-rust/mp4parse/src/fallible.rs:283:13\n #9 0x55fcb92ea65b in mp4parse::fallible::try_read_up_to::h64a356817b37893a mp4parse-rust/mp4parse/src/fallible.rs:75:5\n #10 0x55fcb92f69a4 in _$LT$mp4parse..BMFFBox$LT$T$GT$$u20$as$u20$mp4parse..fallible..TryRead$GT$::try_read_to_end::h37ff3f8c67f3ab87 mp4parse-rust/mp4parse/src/fallible.rs:48:9\n #11 0x55fcb92f69a4 in mp4parse::fallible::TryRead::read_into_try_vec::h1a15ad50dda088e3 mp4parse-rust/mp4parse/src/fallible.rs:41:17\n #12 0x55fcb93196ff in mp4parse::read_iloc::hcabc592b0f73799c mp4parse-rust/mp4parse/src/lib.rs:1484:16\n #13 0x55fcb9299568 in mp4parse::read_avif_meta::h6463196551ec8476 mp4parse-rust/mp4parse/src/lib.rs:1340:35\n #14 0x55fcb930161d in mp4parse::read_avif::h085d003469ed626b mp4parse-rust/mp4parse/src/lib.rs:1249:40\n #15 0x55fcb9396625 in _$LT$mp4parse_capi..Mp4parseAvifParser$u20$as$u20$mp4parse_capi..ContextParser$GT$::read::h3b7d4d3db512bcae mp4parse-rust/mp4parse_capi/src/lib.rs:377:9\n #16 0x55fcb9396625 in mp4parse_capi::mp4parse_new_common_safe::h0ca2c54532ffc785 mp4parse-rust/mp4parse_capi/src/lib.rs:482:5\n #17 0x55fcb9395c07 in mp4parse_capi::mp4parse_new_common::h5bcbdbc95c2c6730 mp4parse-rust/mp4parse_capi/src/lib.rs:467:15\n #18 0x55fcb9395c07 in mp4parse_avif_new mp4parse-rust/mp4parse_capi/src/lib.rs:451:5\n #19 0x55fcb921f598 in rust_fuzzer_test_input mp4parse-rust/mp4parse_capi/fuzz/fuzz_targets/avif.rs:28:12\n #20 0x55fcb941e4a0 in __rust_try\n #21 0x55fcb941e0df in std::panicking::try::hfc14f47abd791d38 /rustc/3a7dfda40a3e798bf086bd58cc7e5e09deb808b5/src/libstd/panicking.rs:274:15\n #22 0x55fcb941e0df in std::panic::catch_unwind::h3c37ac4d75f6cfa4 /rustc/3a7dfda40a3e798bf086bd58cc7e5e09deb808b5/src/libstd/panic.rs:394:14\n #23 0x55fcb941e0df in LLVMFuzzerTestOneInput /rust/registry/src/github.com-1ecc6299db9ec823/libfuzzer-sys-0.3.2/src/lib.rs:25:22\n #24 0x55fcb946a6f6 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:556:15\n #25 0x55fcb941edb3 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:296:6\n #26 0x55fcb942c252 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:776:9\n #27 0x55fcb941ca97 in main /src/libfuzzer/FuzzerMain.cpp:19:10\n #28 0x7efeaef1a82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/libc-start.c:291\n #29 0x55fcb916c6f8 in _start\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x35427)\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/sanitizer_signal_abrt.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@sanitizer_signal_abrt.txt.snap similarity index 81% rename from src/agent/libclusterfuzz/data/parsed-traces/sanitizer_signal_abrt.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@sanitizer_signal_abrt.txt.snap index f1df1db452..4e8be2844c 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/sanitizer_signal_abrt.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@sanitizer_signal_abrt.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/sanitizer_signal_abrt.txt +--- { "text": "ASAN:SIGABRT\n==28640==ERROR: AddressSanitizer: ABRT (pc 0x7f8632666425 sp 0x7fff0cae8f08 bp 0x7fff0cae91d0 T0)\n #0 0x7f8632666424 (/lib/x86_64-linux-gnu/libc-2.15.so+0x36424)\n #1 0x7f8632669b8a (/lib/x86_64-linux-gnu/libc-2.15.so+0x39b8a)\n #2 0x42b11e (/tmp/coredump+0x42b11e)\n #3 0x7f863265176c (/lib/x86_64-linux-gnu/libc-2.15.so+0x2176c)\n #4 0x42ae7c (/tmp/coredump+0x42ae7c)\nAborted (core dumped)\n\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/sanitizer_signal_abrt_unknown.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@sanitizer_signal_abrt_unknown.txt.snap similarity index 93% rename from src/agent/libclusterfuzz/data/parsed-traces/sanitizer_signal_abrt_unknown.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@sanitizer_signal_abrt_unknown.txt.snap index e6efc91348..c55f0e4cde 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/sanitizer_signal_abrt_unknown.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@sanitizer_signal_abrt_unknown.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/sanitizer_signal_abrt_unknown.txt +--- { "text": "ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7f24b70be418 bp 0x0000005b6a80 sp 0x7ffe58419768 T0)\nSCARINESS: 10 (signal)\n #0 0x7f24b70be417 in gsignal\n #1 0x7f24b70c0019 in abort\n #2 0x7f24b70b6bd6 in libc.so.6\n #3 0x7f24b70b6c81 in __assert_fail\n #4 0x512b27 in LLVMFuzzerTestOneInput\n /src/json/test/src/fuzzer-parse_msgpack.cpp:45:13\n #5 0x5122e3 in main /src/libfuzzer/afl/afl_driver.cpp:287:7\n #6 0x7f24b70a982f in __libc_start_main\n #7 0x41b588 in _start\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x35417)\n==1==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/security_dcheck_failure_with_abrt.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@security_dcheck_failure_with_abrt.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/security_dcheck_failure_with_abrt.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@security_dcheck_failure_with_abrt.txt.snap index 2a69b22806..86ddd63e0b 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/security_dcheck_failure_with_abrt.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@security_dcheck_failure_with_abrt.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/security_dcheck_failure_with_abrt.txt +--- { "text": "[1:1:0606/183214.734760:FATAL:SVGElement.cpp(443)] Security DCHECK failed: !root_parent->IsSVGElement() || !ToSVGElement(root_parent) ->elements_with_relative_lengths_.Contains(this).\n\nASAN:DEADLYSIGNAL\n=================================================================\n==1==ERROR: AddressSanitizer: ABRT on unknown address 0x03e900000001 (pc 0x7f2500b1dc37 bp 0x7fff03998210 sp 0x7fff039980d8 T0)\nSCARINESS: 10 (signal)\n #0 0x7f2500b1dc36 in gsignal /build/eglibc-MjiXCM/eglibc-2.19/nptl/sysdeps/unix/sysv/linux/raise.c:56\n #1 0x7f250ddfd0e2 in logging::LogMessage::~LogMessage() base/logging.cc:783:7\n #2 0x7f2517714f19 in blink::SVGElement::RemovedFrom(blink::ContainerNode*) third_party/WebKit/Source/core/svg/SVGElement.cpp:441:3\n #3 0x7f251c4b5cda in blink::ContainerNode::NotifyNodeRemoved(blink::Node&) third_party/WebKit/Source/core/dom/ContainerNode.cpp:842:10\n #4 0x7f251c4b627b in blink::ContainerNode::RemoveChildren(blink::SubtreeModificationAction) third_party/WebKit/Source/core/dom/ContainerNode.cpp:721:9\n #5 0x7f251cb22de9 in blink::ReplaceChildrenWithFragment(blink::ContainerNode*, blink::DocumentFragment*, blink::ExceptionState&) third_party/WebKit/Source/core/editing/serializers/Serialization.cpp:706:19\n #6 0x7f251c5feba8 in blink::Element::setInnerHTML(WTF::String const&, blink::ExceptionState&) third_party/WebKit/Source/core/dom/Element.cpp:2914:5\n #7 0x7f251b5dc3cf in innerHTMLAttributeSetter out/Release/gen/blink/bindings/core/v8/V8Element.cpp:337:9\n #8 0x7f251b5dc3cf in blink::V8Element::innerHTMLAttributeSetterCallback(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8Element.cpp:2139\n #8 0x7f24cf184642 ()\n #9 0x7f24cf0eef8a ()\n #10 0x7f24cf0bb8b4 ()\n #11 0x7f24cf005bda ()\n #12 0x7f24cf0bac78 ()\n #13 0x7f24cf00410c ()\n #9 0x7f250b6839cf in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle, v8::internal::Execution::MessageHandling) v8/src/execution.cc:145:13\n #10 0x7f250b683167 in CallInternal v8/src/execution.cc:181:10\n #11 0x7f250b683167 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:191\n #12 0x7f250a97e944 in v8::Function::Call(v8::Local, v8::Local, int, v8::Local*) v8/src/api.cc:5255:7\n #13 0x7f251b462389 in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp:679:17\n #14 0x7f251b4db5dc in blink::V8EventListener::CallListenerFunction(blink::ScriptState*, v8::Local, blink::Event*) third_party/WebKit/Source/bindings/core/v8/V8EventListener.cpp:115:8\n #15 0x7f251b4d738c in blink::V8AbstractEventListener::InvokeEventHandler(blink::ScriptState*, blink::Event*, v8::Local) third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:146:20\n #16 0x7f251b4d6df1 in blink::V8AbstractEventListener::HandleEvent(blink::ScriptState*, blink::Event*) third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:104:3\n #17 0x7f251b4d6a45 in blink::V8AbstractEventListener::handleEvent(blink::ExecutionContext*, blink::Event*) third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:92:3\n #18 0x7f25165eaf9e in blink::EventTarget::FireEventListeners(blink::Event*, blink::EventTargetData*, blink::HeapVector&) third_party/WebKit/Source/core/events/EventTarget.cpp:751:15\n #19 0x7f25165e8b66 in blink::EventTarget::FireEventListeners(blink::Event*) third_party/WebKit/Source/core/events/EventTarget.cpp:611:29\n #20 0x7f251c6dc2a3 in blink::Node::HandleLocalEvents(blink::Event&) third_party/WebKit/Source/core/dom/Node.cpp:2172:3\n #21 0x7f25165f5b8b in blink::NodeEventContext::HandleLocalEvents(blink::Event&) const third_party/WebKit/Source/core/events/NodeEventContext.cpp:63:10\n #22 0x7f25165c591f in blink::EventDispatcher::DispatchEventAtBubbling() third_party/WebKit/Source/core/events/EventDispatcher.cpp:221:19\n #23 0x7f25165c43c0 in blink::EventDispatcher::Dispatch() third_party/WebKit/Source/core/events/EventDispatcher.cpp:156:9\n #24 0x7f25165c25e5 in blink::EventDispatcher::DispatchEvent(blink::Node&, blink::EventDispatchMediator*) third_party/WebKit/Source/core/events/EventDispatcher.cpp:59:20\n #25 0x7f25165f642d in DispatchEvent third_party/WebKit/Source/core/events/ScopedEventQueue.cpp:77:3\n #26 0x7f25165f642d in blink::ScopedEventQueue::EnqueueEventDispatchMediator(blink::EventDispatchMediator*) third_party/WebKit/Source/core/events/ScopedEventQueue.cpp:63\n #27 0x7f251c6dc8d1 in DispatchScopedEvent third_party/WebKit/Source/core/dom/Node.cpp:2177:3\n #28 0x7f251c6dc8d1 in blink::Node::DispatchSubtreeModifiedEvent() third_party/WebKit/Source/core/dom/Node.cpp:2195\n #29 0x7f251c4aff38 in blink::ContainerNode::DidInsertNodeVector(blink::HeapVector, 11ul> const&, blink::Node*, blink::HeapVector, 11ul> const&) third_party/WebKit/Source/core/dom/ContainerNode.cpp:273:3\n #30 0x7f251c4b2de2 in blink::ContainerNode::ReplaceChild(blink::Node*, blink::Node*, blink::ExceptionState&) third_party/WebKit/Source/core/dom/ContainerNode.cpp:523:3\n #31 0x7f251c6bd972 in blink::Node::replaceChild(blink::Node*, blink::Node*, blink::ExceptionState&) third_party/WebKit/Source/core/dom/Node.cpp:432:35\n #32 0x7f251b62cf14 in replaceChildMethodForMainWorld out/Release/gen/blink/bindings/core/v8/V8Node.cpp:651:24\n #33 0x7f251b62cf14 in blink::V8Node::replaceChildMethodCallbackForMainWorld(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8Node.cpp:871\n #34 0x7f250a916a70 in v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo const&)) v8/src/api-arguments.cc:25:3\n #35 0x7f250ab33ae5 in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::BuiltinArguments) v8/src/builtins/builtins-api.cc:112:36\n #36 0x7f250ab30cc2 in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-api.cc:142:5\n #38 0x7f24cf00463c ()\n #39 0x7f24cf0f4e09 ()\n #40 0x7f24cf0bb8b4 ()\n #41 0x7f24cf005bda ()\n #42 0x7f24cf0bac78 ()\n #43 0x7f24cf00410c ()\n #37 0x7f250b6839cf in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle, v8::internal::Execution::MessageHandling) v8/src/execution.cc:145:13\n #38 0x7f250b683167 in CallInternal v8/src/execution.cc:181:10\n #39 0x7f250b683167 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:191\n #40 0x7f250a97e944 in v8::Function::Call(v8::Local, v8::Local, int, v8::Local*) v8/src/api.cc:5255:7\n #41 0x7f251b462389 in blink::V8ScriptRunner::CallFunction(v8::Local, blink::ExecutionContext*, v8::Local, int, v8::Local*, v8::Isolate*) third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp:679:17\n #42 0x7f251b4db5dc in blink::V8EventListener::CallListenerFunction(blink::ScriptState*, v8::Local, blink::Event*) third_party/WebKit/Source/bindings/core/v8/V8EventListener.cpp:115:8\n #43 0x7f251b4d738c in blink::V8AbstractEventListener::InvokeEventHandler(blink::ScriptState*, blink::Event*, v8::Local) third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:146:20\n #44 0x7f251b4d6df1 in blink::V8AbstractEventListener::HandleEvent(blink::ScriptState*, blink::Event*) third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:104:3\n #45 0x7f251b4d6a45 in blink::V8AbstractEventListener::handleEvent(blink::ExecutionContext*, blink::Event*) third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:92:3\n #46 0x7f25165eaf9e in blink::EventTarget::FireEventListeners(blink::Event*, blink::EventTargetData*, blink::HeapVector&) third_party/WebKit/Source/core/events/EventTarget.cpp:751:15\n #47 0x7f25165e8b66 in blink::EventTarget::FireEventListeners(blink::Event*) third_party/WebKit/Source/core/events/EventTarget.cpp:611:29\n #48 0x7f251c6dc2a3 in blink::Node::HandleLocalEvents(blink::Event&) third_party/WebKit/Source/core/dom/Node.cpp:2172:3\n #49 0x7f25165f5b8b in blink::NodeEventContext::HandleLocalEvents(blink::Event&) const third_party/WebKit/Source/core/events/NodeEventContext.cpp:63:10\n #50 0x7f25165c524d in blink::EventDispatcher::DispatchEventAtCapturing() third_party/WebKit/Source/core/events/EventDispatcher.cpp:194:19\n #51 0x7f25165c415d in blink::EventDispatcher::Dispatch() third_party/WebKit/Source/core/events/EventDispatcher.cpp:154:9\n #52 0x7f25165c25e5 in blink::EventDispatcher::DispatchEvent(blink::Node&, blink::EventDispatchMediator*) third_party/WebKit/Source/core/events/EventDispatcher.cpp:59:20\n #53 0x7f25165f6acf in DispatchEvent third_party/WebKit/Source/core/events/ScopedEventQueue.cpp:77:3\n #54 0x7f25165f6acf in DispatchAllEvents third_party/WebKit/Source/core/events/ScopedEventQueue.cpp:71\n #55 0x7f25165f6acf in blink::ScopedEventQueue::DecrementScopingLevel() third_party/WebKit/Source/core/events/ScopedEventQueue.cpp:95\n #56 0x7f251c897340 in blink::DOMSelection::deleteFromDocument() third_party/WebKit/Source/core/editing/DOMSelection.cpp:682:12\n #57 0x7f251baa46b9 in deleteFromDocumentMethod out/Release/gen/blink/bindings/core/v8/V8Selection.cpp:414:9\n #58 0x7f251baa46b9 in blink::V8Selection::deleteFromDocumentMethodCallback(v8::FunctionCallbackInfo const&) out/Release/gen/blink/bindings/core/v8/V8Selection.cpp:604\n #59 0x7f250a916a70 in v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo const&)) v8/src/api-arguments.cc:25:3\n #60 0x7f250ab33ae5 in v8::internal::MaybeHandle v8::internal::(anonymous namespace)::HandleApiCallHelper(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle, v8::internal::BuiltinArguments) v8/src/builtins/builtins-api.cc:112:36\n #61 0x7f250ab30cc2 in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-api.cc:142:5\n #65 0x7f24cf00463c ()\n #66 0x7f24cf0f4b88 ()\n #67 0x7f24cf0bb8b4 ()\n #68 0x7f24cf0bac78 ()\n #69 0x7f24cf00410c ()\n #62 0x7f250b6839cf in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle, v8::internal::Execution::MessageHandling) v8/src/execution.cc:145:13\n #63 0x7f250b683167 in CallInternal v8/src/execution.cc:181:10\n #64 0x7f250b683167 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) v8/src/execution.cc:191\n #65 0x7f250a939177 in v8::Script::Run(v8::Local) v8/src/api.cc:2057:7\n #66 0x7f251b45ffd5 in blink::V8ScriptRunner::RunCompiledScript(v8::Isolate*, v8::Local, blink::ExecutionContext*) third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp:573:22\n #67 0x7f251b40a9ec in blink::ScriptController::ExecuteScriptAndReturnValue(v8::Local, blink::ScriptSourceCode const&, blink::AccessControlStatus) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:135:10\n #68 0x7f251b40d057 in blink::ScriptController::EvaluateScriptInMainWorld(blink::ScriptSourceCode const&, blink::AccessControlStatus, blink::ScriptController::ExecuteScriptPolicy) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:313:33\n #69 0x7f251b40d5df in blink::ScriptController::ExecuteScriptInMainWorld(blink::ScriptSourceCode const&, blink::AccessControlStatus) third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:283:3\n #70 0x7f251f25ae05 in blink::ScriptLoader::DoExecuteScript(blink::Script const*) third_party/WebKit/Source/core/dom/ScriptLoader.cpp:883:11\n #71 0x7f251f25521f in ExecuteScript third_party/WebKit/Source/core/dom/ScriptLoader.cpp:789:17\n #72 0x7f251f25521f in blink::ScriptLoader::PrepareScript(WTF::TextPosition const&, blink::ScriptLoader::LegacyTypeSupport) third_party/WebKit/Source/core/dom/ScriptLoader.cpp:677\n #73 0x7f251ce28ddd in blink::HTMLParserScriptRunner::ProcessScriptElementInternal(blink::Element*, WTF::TextPosition const&) third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp:627:20\n #74 0x7f251ce285f8 in blink::HTMLParserScriptRunner::ProcessScriptElement(blink::Element*, WTF::TextPosition const&) third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp:408:3\n #75 0x7f251cdc609e in RunScriptsForPausedTreeBuilder third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:292:21\n #76 0x7f251cdc609e in blink::HTMLDocumentParser::ProcessTokenizedChunkFromBackgroundParser(std::__1::unique_ptr >) third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:574\n #77 0x7f251cdbec0b in blink::HTMLDocumentParser::PumpPendingSpeculations() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:632:9\n #78 0x7f251619008f in Run base/callback.h:80:12\n #79 0x7f251619008f in operator() third_party/WebKit/Source/platform/wtf/Functional.h:221\n #80 0x7f251619008f in blink::TaskHandle::Runner::Run(blink::TaskHandle const&) third_party/WebKit/Source/platform/WebTaskRunner.cpp:75\n #81 0x7f250dff6f81 in Run base/callback.h:91:12\n #82 0x7f250dff6f81 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:59\n #83 0x7f251657ad0a in blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(blink::scheduler::internal::WorkQueue*, bool, blink::scheduler::LazyNow, base::TimeTicks*) third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:531:19\n #84 0x7f2516574018 in blink::scheduler::TaskQueueManager::DoWork(bool) third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:329:13\n #85 0x7f250dff6f81 in Run base/callback.h:91:12\n #86 0x7f250dff6f81 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:59\n #87 0x7f250de19969 in base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:418:19\n #88 0x7f250de1aa80 in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask) base/message_loop/message_loop.cc:429:5\n #89 0x7f250de1ba24 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:536:13\n #90 0x7f250de23f5f in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:33:31\n #91 0x7f250dea989a in base::RunLoop::Run() base/run_loop.cc:111:14\n #92 0x7f251808f08d in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:219:23\n #93 0x7f250cf041d0 in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:340:14\n #94 0x7f250cf08126 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:704:12\n #95 0x7f250cf24f3e in service_manager::Main(service_manager::MainParams const&) services/service_manager/embedder/main.cc:469:29\n #96 0x7f250cf0386f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:10\n #97 0x7f25073ca3f3 in ChromeMain chrome/app/chrome_main.cc:109:12\n #98 0x7f2500b08f44 in __libc_start_main /build/eglibc-MjiXCM/eglibc-2.19/csu/libc-start.c:287\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x36c36)\n==1==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/swift_invalid_free.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@swift_invalid_free.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/swift_invalid_free.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@swift_invalid_free.txt.snap index bd23494818..c5bcabf6dc 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/swift_invalid_free.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@swift_invalid_free.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/swift_invalid_free.txt +--- { "text": "#119317\tREDUCE cov: 1886 ft: 6101 corp: 488/10448b lim: 122 exec/s: 7954 rss: 159Mb L: 23/122 MS: 1 EraseBytes-\nAssertion failed: file SwiftProtobuf/BinaryDecoder.swift, line 953\nCurrent stack trace:\n0 swift-protobuf-fuzz 0x0000555f6035db52 + 32258898\n1 swift-protobuf-fuzz 0x0000555f603b53a3 + 32617379\n2 swift-protobuf-fuzz 0x0000555f600b6be5 + 29477861\n3 swift-protobuf-fuzz 0x0000555f600b6827 + 29476903\n4 swift-protobuf-fuzz 0x0000555f600b6e12 + 29478418\n5 swift-protobuf-fuzz 0x0000555f600b5465 + 29471845\n6 swift-protobuf-fuzz 0x0000555f5ee33780 + 10065792\n7 swift-protobuf-fuzz 0x0000555f5ee31df0 BinaryDecoder.decodeSingularGroupField(value:) + 2648\n8 swift-protobuf-fuzz 0x0000555f5ee5020e + 10183182\n9 swift-protobuf-fuzz 0x0000555f5fa6a7ac + 22874028\n10 swift-protobuf-fuzz 0x0000555f5fa62a93 + 22842003\n11 swift-protobuf-fuzz 0x0000555f5fabb562 + 23205218\n12 swift-protobuf-fuzz 0x0000555f5fa83369 + 22975337\n13 swift-protobuf-fuzz 0x0000555f5fabb5e7 + 23205351\n14 swift-protobuf-fuzz 0x0000555f6019539c + 30389148\n15 swift-protobuf-fuzz 0x0000555f5fa613b0 ProtobufUnittest_TestAllTypes.decodeMessage(decoder:) + 1797\n16 swift-protobuf-fuzz 0x0000555f5fabc2ce + 23208654\n17 swift-protobuf-fuzz 0x0000555f5ee303e0 BinaryDecoder.decodeFullMessage(message:) + 1090\n18 swift-protobuf-fuzz 0x0000555f5ee2f210 BinaryDecoder.decodeSingularMessageField(value:) + 3835\n19 swift-protobuf-fuzz 0x0000555f5ee5008e + 10182798\n20 swift-protobuf-fuzz 0x0000555f5fad9f2c + 23330604\n21 swift-protobuf-fuzz 0x0000555f5fad93c5 + 23327685\n22 swift-protobuf-fuzz 0x0000555f5fad9622 + 23328290\n23 swift-protobuf-fuzz 0x0000555f5fada6d9 + 23332569\n24 swift-protobuf-fuzz 0x0000555f5fada7a7 + 23332775\n25 swift-protobuf-fuzz 0x0000555f6019539c + 30389148\n26 swift-protobuf-fuzz 0x0000555f5fad8490 ProtobufUnittest_NestedTestAllTypes.decodeMessage(decoder:) + 1797\n27 swift-protobuf-fuzz 0x0000555f5fadfa7e + 23353982\n28 swift-protobuf-fuzz 0x0000555f5ee303e0 BinaryDecoder.decodeFullMessage(message:) + 1090\n29 swift-protobuf-fuzz 0x0000555f5f0d9480 Message._merge(rawBuffer:extensions:partial:options:) + 2647\n30 swift-protobuf-fuzz 0x0000555f5f0d921b + 12841499\n31 swift-protobuf-fuzz 0x0000555f5f0d9468 + 12842088\n32 swift-protobuf-fuzz 0x0000555f5edc89d9 + 9628121\n33 swift-protobuf-fuzz 0x0000555f5f0da4bf + 12846271\n34 swift-protobuf-fuzz 0x0000555f5fe7f6b9 + 27154105\n35 swift-protobuf-fuzz 0x0000555f5fe8584b + 27179083\n36 swift-protobuf-fuzz 0x0000555f5fe89a39 + 27195961\n37 swift-protobuf-fuzz 0x0000555f5fe8f984 + 27220356\n38 swift-protobuf-fuzz 0x0000555f5f0d5d90 Message.merge(contiguousBytes:extensions:partial:options:) + 3291\n39 swift-protobuf-fuzz 0x0000555f5f0d4f40 Message.init(serializedData:extensions:partial:options:) + 2737\n40 swift-protobuf-fuzz 0x0000555f5f58df00 test(_:_:) + 2066\n41 swift-protobuf-fuzz 0x0000555f5f58dea0 LLVMFuzzerTestOneInput + 81\n42 swift-protobuf-fuzz 0x0000555f5eca5ef2 + 8437490\n43 swift-protobuf-fuzz 0x0000555f5eca5636 + 8435254\n44 swift-protobuf-fuzz 0x0000555f5eca73a8 + 8442792\n45 swift-protobuf-fuzz 0x0000555f5eca80b6 + 8446134\n46 swift-protobuf-fuzz 0x0000555f5ec9de5f + 8404575\n47 swift-protobuf-fuzz 0x0000555f5ecb7d53 + 8510803\n48 libc.so.6 0x00007f87e963b750 __libc_start_main + 240\n49 swift-protobuf-fuzz 0x0000555f5ec94e40 _start + 41\n=================================================================\n==2598==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x555f65177ff0 in thread T0\n #0 0x555f5ed935cd in __interceptor_free /home/buildnode/jenkins/workspace/oss-swift-5.3-package-linux-ubuntu-16_04/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3\n #1 0x555f603b53ac in _swift_stdlib_reportFatalErrorInFile (/out/swift-protobuf-fuzz+0x1f1b3ac)\n #2 0x555f600b6be4 in closure #1 (Swift.UnsafeBufferPointer) -> () in closure #1 (Swift.UnsafeBufferPointer) -> () in closure #1 (Swift.UnsafeBufferPointer) -> () in Swift._assertionFailure(_: Swift.StaticString, _: Swift.String, file: Swift.StaticString, line: Swift.UInt, flags: Swift.UInt32) -> Swift.Never Swift.o\n #3 0x555f600b6826 in closure #1 (Swift.UnsafeBufferPointer) -> () in closure #1 (Swift.UnsafeBufferPointer) -> () in Swift._assertionFailure(_: Swift.StaticString, _: Swift.String, file: Swift.StaticString, line: Swift.UInt, flags: Swift.UInt32) -> Swift.Never Swift.o\n #4 0x555f600b6e11 in function signature specialization ) -> () in closure #1 (Swift.UnsafeBufferPointer) -> () in Swift._assertionFailure(_: Swift.StaticString, _: Swift.String, file: Swift.StaticString, line: Swift.UInt, flags: Swift.UInt32) -> Swift.Never, Argument Types : [Swift.StaticStringSwift.UnsafeBufferPointerSwift.UIntSwift.UInt32]> of generic specialization <()> of Swift.String.withUTF8((Swift.UnsafeBufferPointer) throws -> A) throws -> A (/out/swift-protobuf-fuzz+0x1c1ce11)\n #5 0x555f600b5464 in Swift._assertionFailure(_: Swift.StaticString, _: Swift.String, file: Swift.StaticString, line: Swift.UInt, flags: Swift.UInt32) -> Swift.Never (/out/swift-protobuf-fuzz+0x1c1b464)\n #6 0x555f5ee3377f in SwiftProtobuf.BinaryDecoder.(decodeFullGroup in _5FB1CFBCD94CAF2E3EDFB98EFEFF52A1)(group: inout A, fieldNumber: Swift.Int) throws -> Swift.Bool /src/swift-protobuf/Sources/SwiftProtobuf/BinaryDecoder.swift:953:9\n #7 0x555f5ee32847 in SwiftProtobuf.BinaryDecoder.decodeSingularGroupField(value: inout Swift.Optional) throws -> () /src/swift-protobuf/Sources/SwiftProtobuf/BinaryDecoder.swift:935:16\n #8 0x555f5ee5020d in protocol witness for SwiftProtobuf.Decoder.decodeSingularGroupField(value: inout Swift.Optional) throws -> () in conformance SwiftProtobuf.BinaryDecoder : SwiftProtobuf.Decoder in SwiftProtobuf /src/swift-protobuf-fuzz/\n #9 0x555f5fa6a7ab in closure #16 () throws -> () in closure #1 (swift_protobuf_fuzz.ProtobufUnittest_TestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) throws -> () in swift_protobuf_fuzz.ProtobufUnittest_TestAllTypes.decodeMessage(decoder: inout A) throws -> () /src/swift-protobuf-fuzz/Sources/swift-protobuf-fuzz/unittest.pb.swift:7591:36\n #10 0x555f5fa62a92 in closure #1 (swift_protobuf_fuzz.ProtobufUnittest_TestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) throws -> () in swift_protobuf_fuzz.ProtobufUnittest_TestAllTypes.decodeMessage(decoder: inout A) throws -> () /src/swift-protobuf-fuzz/Sources/swift-protobuf-fuzz/unittest.pb.swift:7591:22\n #11 0x555f5fabb561 in partial apply forwarder for closure #1 (swift_protobuf_fuzz.ProtobufUnittest_TestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) throws -> () in swift_protobuf_fuzz.ProtobufUnittest_TestAllTypes.decodeMessage(decoder: inout A) throws -> () /src/swift-protobuf-fuzz/\n #12 0x555f5fa83368 in reabstraction thunk helper from @callee_guaranteed (@guaranteed swift_protobuf_fuzz.ProtobufUnittest_TestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) -> (@error @owned Swift.Error) to @escaping @callee_guaranteed (@in_guaranteed swift_protobuf_fuzz.ProtobufUnittest_TestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) -> (@out (), @error @owned Swift.Error) /src/swift-protobuf-fuzz/\n #13 0x555f5fabb5e6 in partial apply forwarder for reabstraction thunk helper from @callee_guaranteed (@guaranteed swift_protobuf_fuzz.ProtobufUnittest_TestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) -> (@error @owned Swift.Error) to @escaping @callee_guaranteed (@in_guaranteed swift_protobuf_fuzz.ProtobufUnittest_TestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) -> (@out (), @error @owned Swift.Error) /src/swift-protobuf-fuzz/\n #14 0x555f6019539b in Swift.withExtendedLifetime(A, (A) throws -> B) throws -> B (/out/swift-protobuf-fuzz+0x1cfb39b)\n #15 0x555f5fa61ab4 in swift_protobuf_fuzz.ProtobufUnittest_TestAllTypes.decodeMessage(decoder: inout A) throws -> () /src/swift-protobuf-fuzz/Sources/swift-protobuf-fuzz/unittest.pb.swift:7570:9\n #16 0x555f5fabc2cd in protocol witness for SwiftProtobuf.Message.decodeMessage(decoder: inout A1) throws -> () in conformance swift_protobuf_fuzz.ProtobufUnittest_TestAllTypes : SwiftProtobuf.Message in swift_protobuf_fuzz /src/swift-protobuf-fuzz/\n #17 0x555f5ee30821 in SwiftProtobuf.BinaryDecoder.decodeFullMessage(message: inout A) throws -> () /src/swift-protobuf/Sources/SwiftProtobuf/BinaryDecoder.swift:923:19\n #18 0x555f5ee3010a in SwiftProtobuf.BinaryDecoder.decodeSingularMessageField(value: inout Swift.Optional) throws -> () /src/swift-protobuf/Sources/SwiftProtobuf/BinaryDecoder.swift:904:24\n #19 0x555f5ee5008d in protocol witness for SwiftProtobuf.Decoder.decodeSingularMessageField(value: inout Swift.Optional) throws -> () in conformance SwiftProtobuf.BinaryDecoder : SwiftProtobuf.Decoder in SwiftProtobuf /src/swift-protobuf-fuzz/\n #20 0x555f5fad9f2b in closure #2 () throws -> () in closure #1 (swift_protobuf_fuzz.ProtobufUnittest_NestedTestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) throws -> () in swift_protobuf_fuzz.ProtobufUnittest_NestedTestAllTypes.decodeMessage(decoder: inout A) throws -> () /src/swift-protobuf-fuzz/Sources/swift-protobuf-fuzz/unittest.pb.swift:8152:35\n #21 0x555f5fad93c4 in closure #1 (swift_protobuf_fuzz.ProtobufUnittest_NestedTestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) throws -> () in swift_protobuf_fuzz.ProtobufUnittest_NestedTestAllTypes.decodeMessage(decoder: inout A) throws -> () /src/swift-protobuf-fuzz/Sources/swift-protobuf-fuzz/unittest.pb.swift:8152:21\n #22 0x555f5fad9621 in partial apply forwarder for closure #1 (swift_protobuf_fuzz.ProtobufUnittest_NestedTestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) throws -> () in swift_protobuf_fuzz.ProtobufUnittest_NestedTestAllTypes.decodeMessage(decoder: inout A) throws -> () /src/swift-protobuf-fuzz/\n #23 0x555f5fada6d8 in reabstraction thunk helper from @callee_guaranteed (@guaranteed swift_protobuf_fuzz.ProtobufUnittest_NestedTestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) -> (@error @owned Swift.Error) to @escaping @callee_guaranteed (@in_guaranteed swift_protobuf_fuzz.ProtobufUnittest_NestedTestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) -> (@out (), @error @owned Swift.Error) /src/swift-protobuf-fuzz/\n #24 0x555f5fada7a6 in partial apply forwarder for reabstraction thunk helper from @callee_guaranteed (@guaranteed swift_protobuf_fuzz.ProtobufUnittest_NestedTestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) -> (@error @owned Swift.Error) to @escaping @callee_guaranteed (@in_guaranteed swift_protobuf_fuzz.ProtobufUnittest_NestedTestAllTypes.(_StorageClass in _D89A7C8F8C53F0C35EBE7D10D835683C)) -> (@out (), @error @owned Swift.Error) /src/swift-protobuf-fuzz/\n #25 0x555f6019539b in Swift.withExtendedLifetime(A, (A) throws -> B) throws -> B (/out/swift-protobuf-fuzz+0x1cfb39b)\n #26 0x555f5fad8b94 in swift_protobuf_fuzz.ProtobufUnittest_NestedTestAllTypes.decodeMessage(decoder: inout A) throws -> () /src/swift-protobuf-fuzz/Sources/swift-protobuf-fuzz/unittest.pb.swift:8145:9\n #27 0x555f5fadfa7d in protocol witness for SwiftProtobuf.Message.decodeMessage(decoder: inout A1) throws -> () in conformance swift_protobuf_fuzz.ProtobufUnittest_NestedTestAllTypes : SwiftProtobuf.Message in swift_protobuf_fuzz /src/swift-protobuf-fuzz/\n #28 0x555f5ee30821 in SwiftProtobuf.BinaryDecoder.decodeFullMessage(message: inout A) throws -> () /src/swift-protobuf/Sources/SwiftProtobuf/BinaryDecoder.swift:923:19\n #29 0x555f5f0d9ed6 in (extension in SwiftProtobuf):SwiftProtobuf.Message._merge(rawBuffer: Swift.UnsafeRawBufferPointer, extensions: Swift.Optional, partial: Swift.Bool, options: SwiftProtobuf.BinaryDecodingOptions) throws -> () /src/swift-protobuf/Sources/SwiftProtobuf/Message+BinaryAdditions.swift:198:19\n #30 0x555f5f0d921a in closure #1 (Swift.UnsafeRawBufferPointer) throws -> () in (extension in SwiftProtobuf):SwiftProtobuf.Message.merge(contiguousBytes: A1, extensions: Swift.Optional, partial: Swift.Bool, options: SwiftProtobuf.BinaryDecodingOptions) throws -> () /src/swift-protobuf/Sources/SwiftProtobuf/Message+BinaryAdditions.swift:178:11\n #31 0x555f5f0d9467 in partial apply forwarder for closure #1 (Swift.UnsafeRawBufferPointer) throws -> () in (extension in SwiftProtobuf):SwiftProtobuf.Message.merge(contiguousBytes: A1, extensions: Swift.Optional, partial: Swift.Bool, options: SwiftProtobuf.BinaryDecodingOptions) throws -> () /src/swift-protobuf-fuzz/\n #32 0x555f5edc89d8 in reabstraction thunk helper from @callee_guaranteed (@unowned Swift.UnsafeRawBufferPointer) -> (@error @owned Swift.Error) to @escaping @callee_guaranteed (@unowned Swift.UnsafeRawBufferPointer) -> (@out (), @error @owned Swift.Error) /src/swift-protobuf-fuzz/\n #33 0x555f5f0da4be in partial apply forwarder for reabstraction thunk helper from @callee_guaranteed (@unowned Swift.UnsafeRawBufferPointer) -> (@error @owned Swift.Error) to @escaping @callee_guaranteed (@unowned Swift.UnsafeRawBufferPointer) -> (@out (), @error @owned Swift.Error) /src/swift-protobuf-fuzz/\n #34 0x555f5fe7f6b8 in Foundation.__DataStorage.withUnsafeBytes(in: Swift.Range, apply: (Swift.UnsafeRawBufferPointer) throws -> A) throws -> A (/out/swift-protobuf-fuzz+0x19e56b8)\n #35 0x555f5fe8584a in Foundation.Data._Representation.withUnsafeBytes((Swift.UnsafeRawBufferPointer) throws -> A) throws -> A (/out/swift-protobuf-fuzz+0x19eb84a)\n #36 0x555f5fe89a38 in Foundation.Data.withUnsafeBytes((Swift.UnsafeRawBufferPointer) throws -> A) throws -> A (/out/swift-protobuf-fuzz+0x19efa38)\n #37 0x555f5fe8f983 in protocol witness for Foundation.ContiguousBytes.withUnsafeBytes((Swift.UnsafeRawBufferPointer) throws -> A1) throws -> A1 in conformance Foundation.Data : Foundation.ContiguousBytes in Foundation (/out/swift-protobuf-fuzz+0x19f5983)\n #38 0x555f5f0d6a6a in (extension in SwiftProtobuf):SwiftProtobuf.Message.merge(contiguousBytes: A1, extensions: Swift.Optional, partial: Swift.Bool, options: SwiftProtobuf.BinaryDecodingOptions) throws -> () /src/swift-protobuf/Sources/SwiftProtobuf/Message+BinaryAdditions.swift:177:15\n #39 0x555f5f0d59f0 in (extension in SwiftProtobuf):SwiftProtobuf.Message.init(serializedData: Foundation.Data, extensions: Swift.Optional, partial: Swift.Bool, options: SwiftProtobuf.BinaryDecodingOptions) throws -> A /src/swift-protobuf/Sources/SwiftProtobuf/Message+BinaryAdditions.swift:83:9\n #40 0x555f5f58e711 in swift_protobuf_fuzz.test(Swift.UnsafeRawPointer, Swift.Int) -> Swift.Int32 /src/swift-protobuf-fuzz/Sources/swift-protobuf-fuzz/main.swift:10:17\n #41 0x555f5f58def0 in LLVMFuzzerTestOneInput /src/swift-protobuf-fuzz/\n #42 0x555f5eca5ef1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /home/buildnode/jenkins/workspace/oss-swift-5.3-package-linux-ubuntu-16_04/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15\n #43 0x555f5eca5635 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /home/buildnode/jenkins/workspace/oss-swift-5.3-package-linux-ubuntu-16_04/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:470:3\n #44 0x555f5eca73a7 in fuzzer::Fuzzer::MutateAndTestOne() /home/buildnode/jenkins/workspace/oss-swift-5.3-package-linux-ubuntu-16_04/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:698:19\n #45 0x555f5eca80b5 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector >&) /home/buildnode/jenkins/workspace/oss-swift-5.3-package-linux-ubuntu-16_04/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:830:5\n #46 0x555f5ec9de5e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /home/buildnode/jenkins/workspace/oss-swift-5.3-package-linux-ubuntu-16_04/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:829:6\n #47 0x555f5ecb7d52 in main /home/buildnode/jenkins/workspace/oss-swift-5.3-package-linux-ubuntu-16_04/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10\n #48 0x7f87e963b83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)\n #49 0x555f5ec94e68 in _start (/out/swift-protobuf-fuzz+0x7fae68)\n\nAddress 0x555f65177ff0 is a wild pointer.\nSUMMARY: AddressSanitizer: bad-free /home/buildnode/jenkins/workspace/oss-swift-5.3-package-linux-ubuntu-16_04/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3 in __interceptor_free\n==2598==ABORTING\nMS: 3 ChangeBinInt-CrossOver-CrossOver-; base unit: 9010ccd6f9cc64a0de93e8508bd91abcb008ba20\n0x12,0x8,0x80,0x1,0x35,0x80,0x12,0x8,0x83,0x1,0xf8,0xf1,0xf1,0xea,0xe,0x1,0x63,0x64,0x64,0x95,0x95,0x0,0x0,0xd5,0xff,0xff,0x0,0x95,0x95,0x0,0x0,0xd5,0x63,0x64,0x30,0x28,0x63,0x63,0x63,0x64,0x64,0x50,0x50,0x50,0x50,0x1,0x2,0x0,0xb3,0xfd,0xff,0xff,0xa,0x0,0xa,0x1,0xa,0xb3,0x0,0x50,0x50,0x2f,0x70,0x8,0x6b,0x50,0x50,0x23,0x23,0x23,0x23,0x23,0x23,0x12,0x8,0x83,0x1,0xf8,0xf1,0xf1,0xea,0xe,0x1,0x23,0x23,0x2b,0x6b,0x23,0x23,0x23,0x23,0x23,0x23,0x23,0xc9,0xc9,0xc9,0xc9,0x80,0xc9,0xc9,0xc9,0xc9,0xc9,0xc9,0xc9,0xc9,0xc9,0xc9,0xc9,0x8,0x3d,0x6b,0x0,0x0,0x3,0xb0,0x1,0x5d,0x70,0x70,0x18,\n\\x12\\x08\\x80\\x015\\x80\\x12\\x08\\x83\\x01\\xf8\\xf1\\xf1\\xea\\x0e\\x01cdd\\x95\\x95\\x00\\x00\\xd5\\xff\\xff\\x00\\x95\\x95\\x00\\x00\\xd5cd0(cccddPPPP\\x01\\x02\\x00\\xb3\\xfd\\xff\\xff\\x0a\\x00\\x0a\\x01\\x0a\\xb3\\x00PP/p\\x08kPP######\\x12\\x08\\x83\\x01\\xf8\\xf1\\xf1\\xea\\x0e\\x01##+k#######\\xc9\\xc9\\xc9\\xc9\\x80\\xc9\\xc9\\xc9\\xc9\\xc9\\xc9\\xc9\\xc9\\xc9\\xc9\\xc9\\x08=k\\x00\\x00\\x03\\xb0\\x01]pp\\x18\nartifact_prefix='./'; Test unit written to ./crash-3c5fa15796018785509fe79c69ccd95c44d6d974\nBase64: EgiAATWAEgiDAfjx8eoOAWNkZJWVAADV//8AlZUAANVjZDAoY2NjZGRQUFBQAQIAs/3//woACgEKswBQUC9wCGtQUCMjIyMjIxIIgwH48fHqDgEjIytrIyMjIyMjI8nJycmAycnJycnJycnJyckIPWsAAAOwAV1wcBg=\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/symbolized_asan_null_dereference.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@symbolized_asan_null_dereference.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/symbolized_asan_null_dereference.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@symbolized_asan_null_dereference.txt.snap index 3658784bc2..f52dd28a17 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/symbolized_asan_null_dereference.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@symbolized_asan_null_dereference.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/symbolized_asan_null_dereference.txt +--- { "text": "[1:1:1204/191823:ERROR:image_metadata_extractor.cc(111)] Couldnt load libexif.\n[10929:10929:1204/191825:ERROR:image_metadata_extractor.cc(111)] Couldnt load libexif.\nASAN:SIGSEGV\n=================================================================\n==8==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x7fd8d523feb2 bp 0x7fff279650b0 sp 0x7fff279650a0 T0)\n #0 0x7fd8d523feb1 in blink::FontMetrics::ascent(blink::FontBaseline) const third_party/WebKit/Source/platform/fonts/FontMetrics.h:93:20\n #1 0x7fd8d63a0800 in blink::RenderListMarker::updateMargins() third_party/WebKit/Source/core/rendering/RenderListMarker.cpp:1426:29\n #2 0x7fd8d6399554 in blink::RenderListItem::updateMarkerLocation() third_party/WebKit/Source/core/rendering/RenderListItem.cpp:307:9\n #3 0x7fd8dbe04fc1 in blink::HTMLLIElement::attach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/html/HTMLLIElement.cpp:101:13\n #4 0x7fd8d52f3871 in blink::ContainerNode::attachChildren(blink::Node::AttachContext const&) third_party/WebKit/Source/core/dom/ContainerNode.h:303:13\n #5 0x7fd8d52f3721 in blink::ContainerNode::attach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/dom/ContainerNode.cpp:828:5\n #6 0x7fd8d53a1a9a in blink::Element::attach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/dom/Element.cpp:1337:5\n #7 0x7fd8dbe04f48 in blink::HTMLLIElement::attach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/html/HTMLLIElement.cpp:80:5\n #8 0x7fd8d53fa280 in blink::Node::reattach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/dom/Node.cpp:892:5\n #9 0x7fd8d53a4074 in blink::Element::recalcOwnStyle(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/Element.cpp:1543:9\n #10 0x7fd8d53a3c96 in blink::Element::recalcStyle(blink::StyleRecalcChange, blink::Text*) third_party/WebKit/Source/core/dom/Element.cpp:1489:22\n #11 0x7fd8d52f7e10 in blink::ContainerNode::recalcChildStyle(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/ContainerNode.cpp:1227:17\n #12 0x7fd8d53a3d23 in blink::Element::recalcStyle(blink::StyleRecalcChange, blink::Text*) third_party/WebKit/Source/core/dom/Element.cpp:1504:13\n #13 0x7fd8d5320c0b in blink::Document::updateStyle(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/Document.cpp:1874:13\n #14 0x7fd8d53201c5 in blink::Document::updateRenderTree(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/Document.cpp:1815:5\n #15 0x7fd8d5327123 in blink::Document::implicitClose() third_party/WebKit/Source/core/dom/Document.cpp:2559:9\n #16 0x7fd8d5de0873 in blink::FrameLoader::checkCompleted() third_party/WebKit/Source/core/loader/FrameLoader.cpp:501:9\n #17 0x7fd8d5dde066 in blink::FrameLoader::finishedParsing() third_party/WebKit/Source/core/loader/FrameLoader.cpp:431:5\n #18 0x7fd8d533dc35 in blink::Document::finishedParsing() third_party/WebKit/Source/core/dom/Document.cpp:4635:9\n #19 0x7fd8d5719deb in blink::HTMLDocumentParser::end() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:815:5\n #20 0x7fd8d57115ed in blink::HTMLDocumentParser::prepareToStopParsing() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:251:5\n #21 0x7fd8d5714e58 in blink::HTMLDocumentParser::processParsedChunkFromBackgroundParser(WTF::PassOwnPtr) third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:475:13\n #22 0x7fd8d5712641 in blink::HTMLDocumentParser::pumpPendingSpeculations() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:519:9\n #23 0x7fd8d5712f95 in blink::HTMLDocumentParser::didReceiveParsedChunkFromBackgroundParser(WTF::PassOwnPtr) third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:349:5\n #24 0x7fd8d5825bb5 in WTF::FunctionWrapper)>::operator()(WTF::WeakPtr const&, WTF::PassOwnPtr) third_party/WebKit/Source/wtf/Functional.h:88:16\n #25 0x7fd8d5825a1f in WTF::BoundFunctionImpl)>, void (WTF::WeakPtr, WTF::PassOwnPtr)>::operator()() third_party/WebKit/Source/wtf/Functional.h:355:16\n #26 0x7fd8d476499a in WTF::callFunctionObject(void*) third_party/WebKit/Source/wtf/MainThread.cpp:65:5\n #27 0x7fd8d27e549c in base::internal::InvokeHelper, void (void* const&)>::MakeItSo(base::internal::RunnableAdapter, void* const&) base/bind_internal.h:381:5\n #28 0x7fd8d2923bb6 in base::debug::TaskAnnotator::RunTask(char const*, char const*, base::PendingTask const&) base/debug/task_annotator.cc:63:3\n #29 0x7fd8d28641e0 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:448:3\n #30 0x7fd8d28648ff in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:458:5\n #31 0x7fd8d2864dfc in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:567:13\n #32 0x7fd8d286d1ac in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:32:21\n #33 0x7fd8d2898483 in base::RunLoop::Run() base/run_loop.cc:55:3\n #34 0x7fd8d2862f42 in base::MessageLoop::Run() base/message_loop/message_loop.cc:310:3\n #35 0x7fd8da33b5dc in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:235:7\n #36 0x7fd8d27cd04e in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:347:14\n #37 0x7fd8d27cf45b in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:789:12\n #38 0x7fd8d27cc5a4 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #39 0x7fd8d17db9f2 in ChromeMain chrome/app/chrome_main.cc:66:12\n #40 0x7fd8c76e9de4 in __libc_start_main /build/buildd/eglibc-2.17/csu/libc-start.c:260\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV ??:0 ??\n==8==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/symbolized_asan_unknown.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@symbolized_asan_unknown.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/symbolized_asan_unknown.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@symbolized_asan_unknown.txt.snap index 1b64002952..3ea1502798 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/symbolized_asan_unknown.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@symbolized_asan_unknown.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/symbolized_asan_unknown.txt +--- { "text": "[1:1:1204/191823:ERROR:image_metadata_extractor.cc(111)] Couldnt load libexif.\n[10929:10929:1204/191825:ERROR:image_metadata_extractor.cc(111)] Couldnt load libexif.\nASAN:SIGSEGV\n=================================================================\n==8==ERROR: AddressSanitizer: SEGV on unknown address 0x000000010018 (pc 0x7fd8d523feb2 bp 0x7fff279650b0 sp 0x7fff279650a0 T0)\n #0 0x7fd8d523feb1 in blink::FontMetrics::ascent(blink::FontBaseline) const third_party/WebKit/Source/platform/fonts/FontMetrics.h:93:20\n #1 0x7fd8d63a0800 in blink::RenderListMarker::updateMargins() third_party/WebKit/Source/core/rendering/RenderListMarker.cpp:1426:29\n #2 0x7fd8d6399554 in blink::RenderListItem::updateMarkerLocation() third_party/WebKit/Source/core/rendering/RenderListItem.cpp:307:9\n #3 0x7fd8dbe04fc1 in blink::HTMLLIElement::attach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/html/HTMLLIElement.cpp:101:13\n #4 0x7fd8d52f3871 in blink::ContainerNode::attachChildren(blink::Node::AttachContext const&) third_party/WebKit/Source/core/dom/ContainerNode.h:303:13\n #5 0x7fd8d52f3721 in blink::ContainerNode::attach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/dom/ContainerNode.cpp:828:5\n #6 0x7fd8d53a1a9a in blink::Element::attach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/dom/Element.cpp:1337:5\n #7 0x7fd8dbe04f48 in blink::HTMLLIElement::attach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/html/HTMLLIElement.cpp:80:5\n #8 0x7fd8d53fa280 in blink::Node::reattach(blink::Node::AttachContext const&) third_party/WebKit/Source/core/dom/Node.cpp:892:5\n #9 0x7fd8d53a4074 in blink::Element::recalcOwnStyle(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/Element.cpp:1543:9\n #10 0x7fd8d53a3c96 in blink::Element::recalcStyle(blink::StyleRecalcChange, blink::Text*) third_party/WebKit/Source/core/dom/Element.cpp:1489:22\n #11 0x7fd8d52f7e10 in blink::ContainerNode::recalcChildStyle(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/ContainerNode.cpp:1227:17\n #12 0x7fd8d53a3d23 in blink::Element::recalcStyle(blink::StyleRecalcChange, blink::Text*) third_party/WebKit/Source/core/dom/Element.cpp:1504:13\n #13 0x7fd8d5320c0b in blink::Document::updateStyle(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/Document.cpp:1874:13\n #14 0x7fd8d53201c5 in blink::Document::updateRenderTree(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/Document.cpp:1815:5\n #15 0x7fd8d5327123 in blink::Document::implicitClose() third_party/WebKit/Source/core/dom/Document.cpp:2559:9\n #16 0x7fd8d5de0873 in blink::FrameLoader::checkCompleted() third_party/WebKit/Source/core/loader/FrameLoader.cpp:501:9\n #17 0x7fd8d5dde066 in blink::FrameLoader::finishedParsing() third_party/WebKit/Source/core/loader/FrameLoader.cpp:431:5\n #18 0x7fd8d533dc35 in blink::Document::finishedParsing() third_party/WebKit/Source/core/dom/Document.cpp:4635:9\n #19 0x7fd8d5719deb in blink::HTMLDocumentParser::end() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:815:5\n #20 0x7fd8d57115ed in blink::HTMLDocumentParser::prepareToStopParsing() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:251:5\n #21 0x7fd8d5714e58 in blink::HTMLDocumentParser::processParsedChunkFromBackgroundParser(WTF::PassOwnPtr) third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:475:13\n #22 0x7fd8d5712641 in blink::HTMLDocumentParser::pumpPendingSpeculations() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:519:9\n #23 0x7fd8d5712f95 in blink::HTMLDocumentParser::didReceiveParsedChunkFromBackgroundParser(WTF::PassOwnPtr) third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:349:5\n #24 0x7fd8d5825bb5 in WTF::FunctionWrapper)>::operator()(WTF::WeakPtr const&, WTF::PassOwnPtr) third_party/WebKit/Source/wtf/Functional.h:88:16\n #25 0x7fd8d5825a1f in WTF::BoundFunctionImpl)>, void (WTF::WeakPtr, WTF::PassOwnPtr)>::operator()() third_party/WebKit/Source/wtf/Functional.h:355:16\n #26 0x7fd8d476499a in WTF::callFunctionObject(void*) third_party/WebKit/Source/wtf/MainThread.cpp:65:5\n #27 0x7fd8d27e549c in base::internal::InvokeHelper, void (void* const&)>::MakeItSo(base::internal::RunnableAdapter, void* const&) base/bind_internal.h:381:5\n #28 0x7fd8d2923bb6 in base::debug::TaskAnnotator::RunTask(char const*, char const*, base::PendingTask const&) base/debug/task_annotator.cc:63:3\n #29 0x7fd8d28641e0 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:448:3\n #30 0x7fd8d28648ff in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:458:5\n #31 0x7fd8d2864dfc in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:567:13\n #32 0x7fd8d286d1ac in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:32:21\n #33 0x7fd8d2898483 in base::RunLoop::Run() base/run_loop.cc:55:3\n #34 0x7fd8d2862f42 in base::MessageLoop::Run() base/message_loop/message_loop.cc:310:3\n #35 0x7fd8da33b5dc in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:235:7\n #36 0x7fd8d27cd04e in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:347:14\n #37 0x7fd8d27cf45b in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:789:12\n #38 0x7fd8d27cc5a4 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #39 0x7fd8d17db9f2 in ChromeMain chrome/app/chrome_main.cc:66:12\n #40 0x7fd8c76e9de4 in __libc_start_main /build/buildd/eglibc-2.17/csu/libc-start.c:260\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV ??:0 ??\n==8==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/tsan_data_race.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@tsan_data_race.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/tsan_data_race.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@tsan_data_race.txt.snap index 809d70e572..5fdf375470 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/tsan_data_race.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@tsan_data_race.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/tsan_data_race.txt +--- { "text": "[18457:18457:0129/154606:ERROR:browser_main_loop.cc(171)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.\n/mnt/scratch0/clusterfuzz/scripts/llvm-symbolizer-linux: /usr/lib/x86_64-linux-gnu/libstdc++.so.6: version `GLIBCXX_3.4.20 not found (required by /mnt/scratch0/clusterfuzz/scripts/llvm-symbolizer-linux)\n==18457==WARNING: Cant read from symbolizer at fd 67\n/mnt/scratch0/clusterfuzz/scripts/llvm-symbolizer-linux: /usr/lib/x86_64-linux-gnu/libstdc++.so.6: version `GLIBCXX_3.4.20 not found (required by /mnt/scratch0/clusterfuzz/scripts/llvm-symbolizer-linux)\n==18457==WARNING: Cant read from symbolizer at fd 67\n/mnt/scratch0/clusterfuzz/scripts/llvm-symbolizer-linux: /usr/lib/x86_64-linux-gnu/libstdc++.so.6: version `GLIBCXX_3.4.20 not found (required by /mnt/scratch0/clusterfuzz/scripts/llvm-symbolizer-linux)\n==18457==WARNING: Cant read from symbolizer at fd 67\n/mnt/scratch0/clusterfuzz/scripts/llvm-symbolizer-linux: /usr/lib/x86_64-linux-gnu/libstdc++.so.6: version `GLIBCXX_3.4.20 not found (required by /mnt/scratch0/clusterfuzz/scripts/llvm-symbolizer-linux)\n==18457==WARNING: Cant read from symbolizer at fd 67\n==18457==WARNING: Failed to use and restart external symbolizer!\n/mnt/scratch0/clusterfuzz/scripts/llvm-symbolizer-linux: /usr/lib/x86_64-linux-gnu/libstdc++.so.6: version `GLIBCXX_3.4.20 not found (required by /mnt/scratch0/clusterfuzz/scripts/llvm-symbolizer-linux)\n==================\nWARNING: ThreadSanitizer: data race (pid=18457)c\n Write of size 4 at 0x7f15d580f30c by thread T11 (mutexes: write M1608):\n #0 0x7f15ceac9f57 in sqlite3StatusSet third_party/sqlite/amalgamation/sqlite3.c:12693:3\n #1 0x7f15ceac9f57 in pcache1Alloc third_party/sqlite/amalgamation/sqlite3.c:35125\n #2 0x7f15ceb0db56 in pcache1AllocPage third_party/sqlite/amalgamation/sqlite3.c:35205:15\n #3 0x7f15ceb0db56 in pcache1Fetch third_party/sqlite/amalgamation/sqlite3.c:35674\n #4 0x7f15ceaa359e in sqlite3PcacheFetch third_party/sqlite/amalgamation/sqlite3.c:34559:13\n #5 0x7f15ceaa359e in sqlite3PagerAcquire third_party/sqlite/amalgamation/sqlite3.c:41408\n #6 0x7f15cebc83f7 in btreeGetPage third_party/sqlite/amalgamation/sqlite3.c:48666:8\n #7 0x7f15cebc83f7 in allocateBtreePage third_party/sqlite/amalgamation/sqlite3.c:52106\n #8 0x7f15cebc422d in btreeCreateTable third_party/sqlite/amalgamation/sqlite3.c:54143:10\n #9 0x7f15cebc422d in sqlite3BtreeCreateTable third_party/sqlite/amalgamation/sqlite3.c:54162\n #10 0x7f15ceba7d2d in sqlite3VdbeExec third_party/sqlite/amalgamation/sqlite3.c:67024:8\n #11 0x7f15ceaa9191 in sqlite3Step third_party/sqlite/amalgamation/sqlite3.c:60748:10\n #12 0x7f15ceaa9191 in sqlite3_step third_party/sqlite/amalgamation/sqlite3.c:60813\n #13 0x7f15ceab2d38 in sqlite3_exec third_party/sqlite/amalgamation/sqlite3.c:86385:12\n #14 0x7f15d0b098c8 in ExecuteAndReturnErrorCode sql/connection.cc:659:10\n #15 0x7f15d0b098c8 in sql::Connection::Execute(char const*) sql/connection.cc:668\n #16 0x7f15d19deb98 in InitMainTable components/autofill/core/browser/webdata/autofill_table.cc:1643:10\n #17 0x7f15d19deb98 in autofill::AutofillTable::CreateTablesIfNecessary() components/autofill/core/browser/webdata/autofill_table.cc:490\n #18 0x7f15d14d6f0e in WebDatabase::Init(base::FilePath const&) components/webdata/common/web_database.cc:120:10\n #19 0x7f15d14daac2 in WebDataServiceBackend::LoadDatabaseIfNecessary() components/webdata/common/web_data_service_backend.cc:52:18\n #20 0x7f15d14da92e in WebDataServiceBackend::InitDatabase() components/webdata/common/web_data_service_backend.cc:34:3\n #21 0x7f15d14d91d3 in Run base/bind_internal.h:185:12\n #22 0x7f15d14d91d3 in MakeItSo base/bind_internal.h:381\n #23 0x7f15d14d91d3 in base::internal::Invoker<1, base::internal::BindState, void (WebDataServiceBackend*), void (scoped_refptr)>, void (WebDataServiceBackend*)>::Run(base::internal::BindStateBase*) base/bind_internal.h:475\n #24 0x7f15cd234501 in Run base/callback.h:396:12\n #25 0x7f15cd234501 in base::debug::TaskAnnotator::RunTask(char const*, char const*, base::PendingTask const&) base/debug/task_annotator.cc:63\n #26 0x7f15cd1bab54 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:458:3\n #27 0x7f15cd1bb224 in DeferOrRunPendingTask base/message_loop/message_loop.cc:468:5\n #28 0x7f15cd1bb224 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:580\n #29 0x7f15cd1be322 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:32:21\n #30 0x7f15cd1ba4cc in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:424:3\n #31 0x7f15cd1d4107 in base::RunLoop::Run() base/run_loop.cc:55:3\n #32 0x7f15cd1b9ea6 in base::MessageLoop::Run() base/message_loop/message_loop.cc:317:3\n #33 0x7f15cd1fd23a in base::Thread::Run(base::MessageLoop*) base/threading/thread.cc:174:3\n #34 0x7f15d0605880 in content::BrowserThreadImpl::DBThreadRun(base::MessageLoop*) content/browser/browser_thread_impl.cc:184:3\n #35 0x7f15d0605ecc in content::BrowserThreadImpl::Run(base::MessageLoop*) content/browser/browser_thread_impl.cc:243:14\n #36 0x7f15cd1fd46e in base::Thread::ThreadMain() base/threading/thread.cc:228:5\n #37 0x7f15cd1f75c1 in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:80:3\n #38 0x7f15cc9f33ee in __tsan_thread_start_func\n\n Previous write of size 4 at 0x7f15d580f30c by thread T22 (mutexes: write M1643):\n #0 0x7f15ceac9f57 in sqlite3StatusSet third_party/sqlite/amalgamation/sqlite3.c:12693:3\n #1 0x7f15ceac9f57 in pcache1Alloc third_party/sqlite/amalgamation/sqlite3.c:35125\n #2 0x7f15ceb0db56 in pcache1AllocPage third_party/sqlite/amalgamation/sqlite3.c:35205:15\n #3 0x7f15ceb0db56 in pcache1Fetch third_party/sqlite/amalgamation/sqlite3.c:35674\n #4 0x7f15ceaa359e in sqlite3PcacheFetch third_party/sqlite/amalgamation/sqlite3.c:34559:13\n #5 0x7f15ceaa359e in sqlite3PagerAcquire third_party/sqlite/amalgamation/sqlite3.c:41408\n #6 0x7f15cebc83f7 in btreeGetPage third_party/sqlite/amalgamation/sqlite3.c:48666:8\n #7 0x7f15cebc83f7 in allocateBtreePage third_party/sqlite/amalgamation/sqlite3.c:52106\n #8 0x7f15cebc422d in btreeCreateTable third_party/sqlite/amalgamation/sqlite3.c:54143:10\n #9 0x7f15cebc422d in sqlite3BtreeCreateTable third_party/sqlite/amalgamation/sqlite3.c:54162\n #10 0x7f15ceba7d2d in sqlite3VdbeExec third_party/sqlite/amalgamation/sqlite3.c:67024:8\n #11 0x7f15ceaa9191 in sqlite3Step third_party/sqlite/amalgamation/sqlite3.c:60748:10\n #12 0x7f15ceaa9191 in sqlite3_step third_party/sqlite/amalgamation/sqlite3.c:60813\n #13 0x7f15ceab2d38 in sqlite3_exec third_party/sqlite/amalgamation/sqlite3.c:86385:12\n #14 0x7f15d0b098c8 in ExecuteAndReturnErrorCode sql/connection.cc:659:10\n #15 0x7f15d0b098c8 in sql::Connection::Execute(char const*) sql/connection.cc:668\n #16 0x7f15d1ab2a11 in history::URLDatabase::CreateURLTable(bool) components/history/core/browser/url_database.cc:611:10\n #17 0x7f15d1aa26aa in history::HistoryDatabase::Init(base::FilePath const&) components/history/core/browser/history_database.cc:90:8\n #18 0x7f15ccc86f45 in history::HistoryBackend::InitImpl(std::__1::basic_string, std::__1::allocator > const&, history::HistoryDatabaseParams const&) chrome/browser/history/history_backend.cc:612:28\n #19 0x7f15ccc86baf in history::HistoryBackend::Init(std::__1::basic_string, std::__1::allocator > const&, bool, history::HistoryDatabaseParams const&) chrome/browser/history/history_backend.cc:235:5\n #20 0x7f15ccacb288 in Run base/bind_internal.h:185:12\n #21 0x7f15ccacb288 in MakeItSo base/bind_internal.h:381\n #22 0x7f15ccacb288 in base::internal::Invoker<4, base::internal::BindState, std::__1::allocator > const&, bool, history::HistoryDatabaseParams const&)>, void (history::HistoryBackend*, std::__1::basic_string, std::__1::allocator > const&, bool, history::HistoryDatabaseParams const&), void (history::HistoryBackend*, std::__1::basic_string, std::__1::allocator >, bool, history::HistoryDatabaseParams)>, void (history::HistoryBackend*, std::__1::basic_string, std::__1::allocator > const&, bool, history::HistoryDatabaseParams const&)>::Run(base::internal::BindStateBase*) base/bind_internal.h:869\n #23 0x7f15cd234501 in Run base/callback.h:396:12\n #24 0x7f15cd234501 in base::debug::TaskAnnotator::RunTask(char const*, char const*, base::PendingTask const&) base/debug/task_annotator.cc:63\n #25 0x7f15cd1bab54 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:458:3\n #26 0x7f15cd1bb224 in DeferOrRunPendingTask base/message_loop/message_loop.cc:468:5\n #27 0x7f15cd1bb224 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:580\n #28 0x7f15cd1be322 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:32:21\n #29 0x7f15cd1ba4cc in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:424:3\n #30 0x7f15cd1d4107 in base::RunLoop::Run() base/run_loop.cc:55:3\n #31 0x7f15cd1b9ea6 in base::MessageLoop::Run() base/message_loop/message_loop.cc:317:3\n #32 0x7f15cd1fd23a in base::Thread::Run(base::MessageLoop*) base/threading/thread.cc:174:3\n #33 0x7f15cd1fd46e in base::Thread::ThreadMain() base/threading/thread.cc:228:5\n #34 0x7f15cd1f75c1 in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:80:3\n #35 0x7f15cc9f33ee in __tsan_thread_start_func\n\n Location is global of size 0 at 0x000000000000 (chrome+0x0000098ae30c)\n\n Mutex M1608 (0x7d0c0002e6b8) created at:\n #0 0x7f15cc9f48f1 in __interceptor_pthread_mutex_init\n #1 0x7f15ceb1c188 in pthreadMutexAlloc third_party/sqlite/amalgamation/sqlite3.c:17171:9\n #2 0x7f15ceabd3c2 in sqlite3MutexAlloc third_party/sqlite/amalgamation/sqlite3.c:16474:10\n #3 0x7f15ceabd3c2 in openDatabase third_party/sqlite/amalgamation/sqlite3.c:109114\n #4 0x7f15ceabd1a8 in sqlite3_open third_party/sqlite/amalgamation/sqlite3.c:109297:10\n #5 0x7f15d0b08ab3 in sql::Connection::OpenInternal(std::__1::basic_string, std::__1::allocator > const&, sql::Connection::Retry) sql/connection.cc:883:13\n #6 0x7f15d0b0899f in sql::Connection::Open(base::FilePath const&) sql/connection.cc:247:10\n #7 0x7f15d14d6d3e in WebDatabase::Init(base::FilePath const&) components/webdata/common/web_database.cc:87:8\n #8 0x7f15d14daac2 in WebDataServiceBackend::LoadDatabaseIfNecessary() components/webdata/common/web_data_service_backend.cc:52:18\n #9 0x7f15d14da92e in WebDataServiceBackend::InitDatabase() components/webdata/common/web_data_service_backend.cc:34:3\n #10 0x7f15d14d91d3 in Run base/bind_internal.h:185:12\n #11 0x7f15d14d91d3 in MakeItSo base/bind_internal.h:381\n #12 0x7f15d14d91d3 in base::internal::Invoker<1, base::internal::BindState, void (WebDataServiceBackend*), void (scoped_refptr)>, void (WebDataServiceBackend*)>::Run(base::internal::BindStateBase*) base/bind_internal.h:475\n #13 0x7f15cd234501 in Run base/callback.h:396:12\n #14 0x7f15cd234501 in base::debug::TaskAnnotator::RunTask(char const*, char const*, base::PendingTask const&) base/debug/task_annotator.cc:63\n #15 0x7f15cd1bab54 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:458:3\n #16 0x7f15cd1bb224 in DeferOrRunPendingTask base/message_loop/message_loop.cc:468:5\n #17 0x7f15cd1bb224 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:580\n #18 0x7f15cd1be322 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:32:21\n #19 0x7f15cd1ba4cc in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:424:3\n #20 0x7f15cd1d4107 in base::RunLoop::Run() base/run_loop.cc:55:3\n #21 0x7f15cd1b9ea6 in base::MessageLoop::Run() base/message_loop/message_loop.cc:317:3\n #22 0x7f15cd1fd23a in base::Thread::Run(base::MessageLoop*) base/threading/thread.cc:174:3\n #23 0x7f15d0605880 in content::BrowserThreadImpl::DBThreadRun(base::MessageLoop*) content/browser/browser_thread_impl.cc:184:3\n #24 0x7f15d0605ecc in content::BrowserThreadImpl::Run(base::MessageLoop*) content/browser/browser_thread_impl.cc:243:14\n #25 0x7f15cd1fd46e in base::Thread::ThreadMain() base/threading/thread.cc:228:5\n #26 0x7f15cd1f75c1 in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:80:3\n #27 0x7f15cc9f33ee in __tsan_thread_start_func\n\n Mutex M1643 (0x7d0c00080f48) created at:\n #0 0x7f15cc9f48f1 in __interceptor_pthread_mutex_init\n #1 0x7f15ceb1c188 in pthreadMutexAlloc third_party/sqlite/amalgamation/sqlite3.c:17171:9\n #2 0x7f15ceabd3c2 in sqlite3MutexAlloc third_party/sqlite/amalgamation/sqlite3.c:16474:10\n #3 0x7f15ceabd3c2 in openDatabase third_party/sqlite/amalgamation/sqlite3.c:109114\n #4 0x7f15ceabd1a8 in sqlite3_open third_party/sqlite/amalgamation/sqlite3.c:109297:10\n #5 0x7f15d0b08ab3 in sql::Connection::OpenInternal(std::__1::basic_string, std::__1::allocator > const&, sql::Connection::Retry) sql/connection.cc:883:13\n #6 0x7f15d0b0899f in sql::Connection::Open(base::FilePath const&) sql/connection.cc:247:10\n #7 0x7f15d1aa263d in history::HistoryDatabase::Init(base::FilePath const&) components/history/core/browser/history_database.cc:68:8\n #8 0x7f15ccc86f45 in history::HistoryBackend::InitImpl(std::__1::basic_string, std::__1::allocator > const&, history::HistoryDatabaseParams const&) chrome/browser/history/history_backend.cc:612:28\n #9 0x7f15ccc86baf in history::HistoryBackend::Init(std::__1::basic_string, std::__1::allocator > const&, bool, history::HistoryDatabaseParams const&) chrome/browser/history/history_backend.cc:235:5\n #10 0x7f15ccacb288 in Run base/bind_internal.h:185:12\n #11 0x7f15ccacb288 in MakeItSo base/bind_internal.h:381\n #12 0x7f15ccacb288 in base::internal::Invoker<4, base::internal::BindState, std::__1::allocator > const&, bool, history::HistoryDatabaseParams const&)>, void (history::HistoryBackend*, std::__1::basic_string, std::__1::allocator > const&, bool, history::HistoryDatabaseParams const&), void (history::HistoryBackend*, std::__1::basic_string, std::__1::allocator >, bool, history::HistoryDatabaseParams)>, void (history::HistoryBackend*, std::__1::basic_string, std::__1::allocator > const&, bool, history::HistoryDatabaseParams const&)>::Run(base::internal::BindStateBase*) base/bind_internal.h:869\n #13 0x7f15cd234501 in Run base/callback.h:396:12\n #14 0x7f15cd234501 in base::debug::TaskAnnotator::RunTask(char const*, char const*, base::PendingTask const&) base/debug/task_annotator.cc:63\n #15 0x7f15cd1bab54 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:458:3\n #16 0x7f15cd1bb224 in DeferOrRunPendingTask base/message_loop/message_loop.cc:468:5\n #17 0x7f15cd1bb224 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:580\n #18 0x7f15cd1be322 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:32:21\n #19 0x7f15cd1ba4cc in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:424:3\n #20 0x7f15cd1d4107 in base::RunLoop::Run() base/run_loop.cc:55:3\n #21 0x7f15cd1b9ea6 in base::MessageLoop::Run() base/message_loop/message_loop.cc:317:3\n #22 0x7f15cd1fd23a in base::Thread::Run(base::MessageLoop*) base/threading/thread.cc:174:3\n #23 0x7f15cd1fd46e in base::Thread::ThreadMain() base/threading/thread.cc:228:5\n #24 0x7f15cd1f75c1 in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:80:3\n #25 0x7f15cc9f33ee in __tsan_thread_start_func\n\n Thread T11 Chrome_DBThread (tid=18472, running) created by main thread at:\n #0 0x7f15cc9f34f2 in __interceptor_pthread_create\n #1 0x7f15cd1f71c0 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) base/threading/platform_thread_posix.cc:120:13\n #2 0x7f15cd1f7032 in base::PlatformThread::Create(unsigned long, base::PlatformThread::Delegate*, base::PlatformThreadHandle*) base/threading/platform_thread_posix.cc:206:10\n #3 0x7f15cd1fd022 in base::Thread::StartWithOptions(base::Thread::Options const&) base/threading/thread.cc:108:8\n #4 0x7f15d08aa009 in content::BrowserMainLoop::CreateThreads() content/browser/browser_main_loop.cc:774:12\n #5 0x7f15d08ae8a3 in Run base/bind_internal.h:185:12\n #6 0x7f15d08ae8a3 in MakeItSo base/bind_internal.h:374\n #7 0x7f15d08ae8a3 in base::internal::Invoker<1, base::internal::BindState, int (content::BrowserMainLoop*), void (base::internal::UnretainedWrapper)>, int (content::BrowserMainLoop*)>::Run(base::internal::BindStateBase*) base/bind_internal.h:475\n #8 0x7f15d0a24f90 in Run base/callback.h:396:12\n #9 0x7f15d0a24f90 in content::StartupTaskRunner::RunAllTasksNow() content/browser/startup_task_runner.cc:45\n #10 0x7f15d08a936d in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:689:3\n #11 0x7f15d06040ae in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams const&) content/browser/browser_main_runner.cc:188:5\n #12 0x7f15d0603c98 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:22:19\n #13 0x7f15cd185b4e in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:423:14\n #14 0x7f15cd1864e2 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:800:12\n #15 0x7f15cd184dff in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #16 0x7f15cca54ba4 in ChromeMain chrome/app/chrome_main.cc:66:12\n #17 0x7f15cca54b1f in main chrome/app/chrome_exe_main_aura.cc:17:10\n #18 0x7f15c41a7ec5 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\n Thread T22 Chrome_HistoryThread (tid=18484, running) created by main thread at:\n #0 0x7f15cc9f34f2 in __interceptor_pthread_create\n #1 0x7f15cd1f71c0 in base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) base/threading/platform_thread_posix.cc:120:13\n #2 0x7f15cd1f7032 in base::PlatformThread::Create(unsigned long, base::PlatformThread::Delegate*, base::PlatformThreadHandle*) base/threading/platform_thread_posix.cc:206:10\n #3 0x7f15cd1fd022 in base::Thread::StartWithOptions(base::Thread::Options const&) base/threading/thread.cc:108:8\n #4 0x7f15ccac7e67 in HistoryService::Init(bool, history::HistoryDatabaseParams const&) chrome/browser/history/history_service.cc:954:8\n #5 0x7f15ccad4f74 in Init chrome/browser/history/history_service.h:103:12\n #6 0x7f15ccad4f74 in HistoryServiceFactory::BuildServiceInstanceFor(content::BrowserContext*) const chrome/browser/history/history_service_factory.cc:81\n #7 0x7f15d16442cd in BrowserContextKeyedServiceFactory::BuildServiceInstanceFor(base::SupportsUserData*) const components/keyed_service/content/browser_context_keyed_service_factory.cc:91:10\n #8 0x7f15d10cc013 in KeyedServiceFactory::GetServiceForContext(base::SupportsUserData*, bool) components/keyed_service/core/keyed_service_factory.cc:87:15\n #9 0x7f15d164417b in BrowserContextKeyedServiceFactory::GetServiceForBrowserContext(content::BrowserContext*, bool) components/keyed_service/content/browser_context_keyed_service_factory.cc:45:10\n #10 0x7f15ccad4c63 in HistoryServiceFactory::GetForProfile(Profile*, ServiceAccessType) chrome/browser/history/history_service_factory.cc:32:7\n #11 0x7f15ccb3f0be in TemplateURLServiceFactory::BuildInstanceFor(content::BrowserContext*) chrome/browser/search_engines/template_url_service_factory.cc:55:11\n #12 0x7f15ccb3f26a in TemplateURLServiceFactory::BuildServiceInstanceFor(content::BrowserContext*) const chrome/browser/search_engines/template_url_service_factory.cc:75:10\n #13 0x7f15d16442cd in BrowserContextKeyedServiceFactory::BuildServiceInstanceFor(base::SupportsUserData*) const components/keyed_service/content/browser_context_keyed_service_factory.cc:91:10\n #14 0x7f15d10cc013 in KeyedServiceFactory::GetServiceForContext(base::SupportsUserData*, bool) components/keyed_service/core/keyed_service_factory.cc:87:15\n #15 0x7f15d164417b in BrowserContextKeyedServiceFactory::GetServiceForBrowserContext(content::BrowserContext*, bool) components/keyed_service/content/browser_context_keyed_service_factory.cc:45:10\n #16 0x7f15ccb3ee77 in TemplateURLServiceFactory::GetForProfile(Profile*) chrome/browser/search_engines/template_url_service_factory.cc:29:7\n #17 0x7f15d171e788 in extensions::OmniboxAPI::OmniboxAPI(content::BrowserContext*) chrome/browser/extensions/api/omnibox/omnibox_api.cc:180:20\n #18 0x7f15d1720cfb in extensions::BrowserContextKeyedAPIFactory::BuildServiceInstanceFor(content::BrowserContext*) const extensions/browser/browser_context_keyed_api_factory.h:107:5\n #19 0x7f15d16442cd in BrowserContextKeyedServiceFactory::BuildServiceInstanceFor(base::SupportsUserData*) const components/keyed_service/content/browser_context_keyed_service_factory.cc:91:10\n #20 0x7f15d10cc013 in KeyedServiceFactory::GetServiceForContext(base::SupportsUserData*, bool) components/keyed_service/core/keyed_service_factory.cc:87:15\n #21 0x7f15d10cc6a6 in KeyedServiceFactory::CreateServiceNow(base::SupportsUserData*) components/keyed_service/core/keyed_service_factory.cc:136:3\n #22 0x7f15d10cdf19 in DependencyManager::CreateContextServices(base::SupportsUserData*, bool) components/keyed_service/core/dependency_manager.cc:73:7\n #23 0x7f15d16437fb in BrowserContextDependencyManager::DoCreateBrowserContextServices(content::BrowserContext*, bool) components/keyed_service/content/browser_context_dependency_manager.cc:44:3\n #24 0x7f15d1643533 in BrowserContextDependencyManager::CreateBrowserContextServices(content::BrowserContext*) components/keyed_service/content/browser_context_dependency_manager.cc:29:3\n #25 0x7f15cccd877b in ProfileImpl::OnPrefsLoaded(bool) chrome/browser/profiles/profile_impl.cc:891:3\n #26 0x7f15cccd8285 in ProfileImpl::ProfileImpl(base::FilePath const&, Profile::Delegate*, Profile::CreateMode, base::SequencedTaskRunner*) chrome/browser/profiles/profile_impl.cc:521:5\n #27 0x7f15cccd706c in Profile::CreateProfile(base::FilePath const&, Profile::Delegate*, Profile::CreateMode) chrome/browser/profiles/profile_impl.cc:295:3\n #28 0x7f15ccb391fe in ProfileManager::CreateProfileHelper(base::FilePath const&) chrome/browser/profiles/profile_manager.cc:1070:10\n #29 0x7f15ccb340fd in ProfileManager::GetProfile(base::FilePath const&) chrome/browser/profiles/profile_manager.cc:383:13\n #30 0x7f15cce56c7e in CreatePrimaryProfile chrome/browser/chrome_browser_main.cc:360:13\n #31 0x7f15cce56c7e in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:1277\n #32 0x7f15cce56212 in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1007:18\n #33 0x7f15d08ab493 in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:791:5\n #34 0x7f15d08ae8a3 in Run base/bind_internal.h:185:12\n #35 0x7f15d08ae8a3 in MakeItSo base/bind_internal.h:374\n #36 0x7f15d08ae8a3 in base::internal::Invoker<1, base::internal::BindState, int (content::BrowserMainLoop*), void (base::internal::UnretainedWrapper)>, int (content::BrowserMainLoop*)>::Run(base::internal::BindStateBase*) base/bind_internal.h:475\n #37 0x7f15d0a24f90 in Run base/callback.h:396:12\n #38 0x7f15d0a24f90 in content::StartupTaskRunner::RunAllTasksNow() content/browser/startup_task_runner.cc:45\n #39 0x7f15d08a936d in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:689:3\n #40 0x7f15d06040ae in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams const&) content/browser/browser_main_runner.cc:188:5\n #41 0x7f15d0603c98 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:22:19\n #42 0x7f15cd185b4e in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:423:14\n #43 0x7f15cd1864e2 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:800:12\n #44 0x7f15cd184dff in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #45 0x7f15cca54ba4 in ChromeMain chrome/app/chrome_main.cc:66:12\n #46 0x7f15cca54b1f in main chrome/app/chrome_exe_main_aura.cc:17:10\n #47 0x7f15c41a7ec5 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287\n\nSUMMARY: ThreadSanitizer: data race ??:0 ??\n==================\n", "sanitizer": "ThreadSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/tsan_use_after_free.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@tsan_use_after_free.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/tsan_use_after_free.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@tsan_use_after_free.txt.snap index 8914398237..e009bb52ee 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/tsan_use_after_free.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@tsan_use_after_free.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/tsan_use_after_free.txt +--- { "text": "==================\nWARNING: ThreadSanitizer: heap-use-after-free (pid=26043)\n Read of size 1 at 0x7d040009c4c8 by main thread (mutexes: write M21069, write M21097, write M21068, write M20937):\n #0 0x7fe7eda2b1bf in memcpy (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd61be)\n #1 0x7fe7e9d5edae in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:51\n #2 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #3 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #4 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #5 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #6 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #7 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #8 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #9 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #10 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #11 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #12 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #13 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Previous write of size 8 at 0x7d040009c4c8 by main thread (mutexes: write M21069, write M21097, write M21068, write M20937):\n #0 0x7fe7eda2adf1 in free (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd5df0)\n #1 0x7fe7ecd659ba in ft_free third_party/freetype2/src/src/base/ftsystem.c:130:5\n #2 0x7fe7ecd77776 in FT_Stream_ExitFrame third_party/freetype2/src/src/base/ftutil.c:171:7\n #3 0x7fe7ecdc02ce in Load_SBit_Image third_party/freetype2/src/src/sfnt/ttsbit.c:1237:7\n #4 0x7fe7ecdbc0a7 in tt_face_load_sbit_image third_party/freetype2/src/src/sfnt/ttsbit.c:1476:13\n #5 0x7fe7ecdc3698 in Load_Glyph third_party/freetype2/src/src/truetype/ttgload.c:1790:13\n #6 0x7fe7ecd6641a in FT_Load_Glyph third_party/freetype2/src/src/base/ftobjs.c:690:15\n #7 0x7fe7e9d5efeb in _cairo_ft_scaled_glyph_init /build/buildd/cairo-1.13.0~20140204/src/cairo-ft-font.c:2249\n #8 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #9 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #10 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #11 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #12 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #13 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #14 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #15 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #16 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #17 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #18 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #19 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Location is heap block of size 8 at 0x7d040009c4c0 allocated by main thread:\n #0 0x7fe7eda2a9d5 in malloc (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd59d4)\n #1 0x7fe7ecd6594a in ft_alloc third_party/freetype2/src/src/base/ftsystem.c:74:12\n #2 0x7fe7ecd69f0b in ft_glyphslot_alloc_bitmap third_party/freetype2/src/src/base/ftutil.c:76:15\n #3 0x7fe7ecdbfbf0 in Load_SBit_Image third_party/freetype2/src/src/sfnt/ttsbit.c:1313:15\n #4 0x7fe7ecdbc0a7 in tt_face_load_sbit_image third_party/freetype2/src/src/sfnt/ttsbit.c:1476:13\n #5 0x7fe7ecdc3698 in Load_Glyph third_party/freetype2/src/src/truetype/ttgload.c:1790:13\n #6 0x7fe7ecd6641a in FT_Load_Glyph third_party/freetype2/src/src/base/ftobjs.c:690:15\n #7 0x7fe7e9d5efeb in _cairo_ft_scaled_glyph_init /build/buildd/cairo-1.13.0~20140204/src/cairo-ft-font.c:2249\n #8 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #9 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #10 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #11 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #12 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #13 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #14 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #15 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #16 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #17 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #18 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #19 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Mutex M21069 (0x7d0c001878c0) created at:\n #0 0x7fe7eda2dc04 in pthread_mutex_init (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd8c03)\n #0 0x7fe7ebf4f5b8 in libglib-2.0.so.0\n #2 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #3 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #4 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #5 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #6 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #7 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #8 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #9 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #10 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #11 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #12 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #13 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Mutex M21097 (0x7d54000a17f0) created at:\n #0 0x7fe7eda4566f in pthread_mutex_lock (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbf066e)\n #1 0x7fe7e9d0de07 in _cairo_scaled_font_freeze_cache /build/buildd/cairo-1.13.0~20140204/src/cairo-scaled-font.c:798\n #2 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #3 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #4 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #5 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #6 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #7 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #8 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #9 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #10 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #11 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #12 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #13 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Mutex M21068 (0x7d7800009028) created at:\n #0 0x7fe7eda2dc04 in pthread_mutex_init (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd8c03)\n #1 0x7fe7e9cd561b in _cairo_device_init /build/buildd/cairo-1.13.0~20140204/src/cairo-device.c:177\n #2 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #3 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #4 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #5 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #6 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #7 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #8 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #9 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #10 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #11 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #12 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #13 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Mutex M20937 (0x7d44000c76d0) created at:\n #0 0x7fe7eda4566f in pthread_mutex_lock (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbf066e)\n #1 0x7fe7e9d5d5b5 in _cairo_ft_unscaled_font_lock_face /build/buildd/cairo-1.13.0~20140204/src/cairo-ft-font.c:649\n #2 0x7fe7f15808d7 in ui::SelectFileDialog::SelectFile(ui::SelectFileDialog::Type, std::__1::basic_string > const&, base::FilePath const&, ui::SelectFileDialog::FileTypeInfo const*, int, std::__1::basic_string, std::__1::allocator > const&, aura::Window*, void*) ui/shell_dialogs/select_file_dialog.cc:100:3\n #3 0x7fe7eddd4846 in SavePackageFilePicker::SavePackageFilePicker(content::WebContents*, base::FilePath const&, std::__1::basic_string, std::__1::allocator > const&, bool, DownloadPrefs*, base::Callback const&), (base::internal::CopyMode)1> const&) chrome/browser/download/save_package_file_picker.cc:214:5\n #4 0x7fe7eddc5793 in ChromeDownloadManagerDelegate::ChooseSavePath(content::WebContents*, base::FilePath const&, std::__1::basic_string, std::__1::allocator > const&, bool, base::Callback const&), (base::internal::CopyMode)1> const&) chrome/browser/download/chrome_download_manager_delegate.cc:425:7\n #5 0x7fe7f1fbd856 in content::SavePackage::ContinueGetSaveInfo(base::FilePath const&, bool) content/browser/download/save_package.cc:1473:3\n #6 0x7fe7f1fc67cf in base::internal::Invoker, base::internal::BindState, void (content::SavePackage*, base::FilePath const&, bool), content::SavePackage*, base::FilePath&, bool&>, base::internal::InvokeHelper >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:181:12\n #7 0x7fe7ee11805e in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/callback.h:397:12\n #8 0x7fe7ee0a1723 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:476:3\n #9 0x7fe7ee0a1cbe in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:485:5\n #10 0x7fe7ee0a20a6 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:597:13\n #11 0x7fe7ee1162d8 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:267:7\n #12 0x7fe7ebf0de04 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x48e03)\n #13 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #14 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #15 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #16 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #17 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #18 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #19 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #20 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #21 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #22 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #23 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\nSUMMARY: ThreadSanitizer: heap-use-after-free (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd61be) in __interceptor_memcpy\n==================\n==================\nWARNING: ThreadSanitizer: heap-use-after-free (pid=26043)\n Read of size 1 at 0x7d08001379d8 by main thread (mutexes: write M21069, write M21097, write M21068, write M20937):\n #0 0x7fe7eda2b1bf in memcpy (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd61be)\n #1 0x7fe7e9d5edae in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:51\n #2 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #3 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #4 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #5 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #6 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #7 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #8 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #9 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #10 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #11 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #12 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #13 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Previous write of size 8 at 0x7d08001379d8 by main thread (mutexes: write M21069, write M21097, write M21068, write M20937):\n #0 0x7fe7eda2adf1 in free (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd5df0)\n #1 0x7fe7ecd659ba in ft_free third_party/freetype2/src/src/base/ftsystem.c:130:5\n #2 0x7fe7ecd660e5 in FT_Load_Glyph third_party/freetype2/src/src/base/ftutil.c:171:7\n #3 0x7fe7e9d5efeb in _cairo_ft_scaled_glyph_init /build/buildd/cairo-1.13.0~20140204/src/cairo-ft-font.c:2249\n #4 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #5 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #6 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #7 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #8 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #9 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #10 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #11 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #12 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #13 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #14 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #15 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Location is heap block of size 24 at 0x7d08001379c0 allocated by main thread:\n #0 0x7fe7eda2a9d5 in malloc (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd59d4)\n #1 0x7fe7ecd6594a in ft_alloc third_party/freetype2/src/src/base/ftsystem.c:74:12\n #2 0x7fe7ecd69f0b in ft_glyphslot_alloc_bitmap third_party/freetype2/src/src/base/ftutil.c:76:15\n #3 0x7fe7ecdbfbf0 in Load_SBit_Image third_party/freetype2/src/src/sfnt/ttsbit.c:1313:15\n #4 0x7fe7ecdbc0a7 in tt_face_load_sbit_image third_party/freetype2/src/src/sfnt/ttsbit.c:1476:13\n #5 0x7fe7ecdc3698 in Load_Glyph third_party/freetype2/src/src/truetype/ttgload.c:1790:13\n #6 0x7fe7ecd6641a in FT_Load_Glyph third_party/freetype2/src/src/base/ftobjs.c:690:15\n #7 0x7fe7e9d5efeb in _cairo_ft_scaled_glyph_init /build/buildd/cairo-1.13.0~20140204/src/cairo-ft-font.c:2249\n #8 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #9 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #10 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #11 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #12 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #13 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #14 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #15 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #16 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #17 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #18 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #19 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Mutex M21069 (0x7d0c001878c0) created at:\n #0 0x7fe7eda2dc04 in pthread_mutex_init (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd8c03)\n #1 0x7fe7ebf4f5b8 in libglib-2.0.so.0\n #2 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #3 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #4 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #5 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #6 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #7 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #8 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #9 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #10 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #11 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #12 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #13 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Mutex M21097 (0x7d54000a17f0) created at:\n #0 0x7fe7eda4566f in pthread_mutex_lock (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbf066e)\n #1 0x7fe7e9d0de07 in _cairo_scaled_font_freeze_cache /build/buildd/cairo-1.13.0~20140204/src/cairo-scaled-font.c:798\n #2 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #3 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #4 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #5 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #6 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #7 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #8 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #9 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #10 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #11 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #12 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #13 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Mutex M21068 (0x7d7800009028) created at:\n #0 0x7fe7eda2dc04 in pthread_mutex_init (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd8c03)\n #1 0x7fe7e9cd561b in _cairo_device_init /build/buildd/cairo-1.13.0~20140204/src/cairo-device.c:177\n #2 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #3 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #4 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #5 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #6 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #7 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #8 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #9 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #10 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #11 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #12 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #13 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Mutex M20937 (0x7d44000c76d0) created at:\n #0 0x7fe7eda4566f in pthread_mutex_lock (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbf066e)\n #1 0x7fe7e9d5d5b5 in _cairo_ft_unscaled_font_lock_face /build/buildd/cairo-1.13.0~20140204/src/cairo-ft-font.c:649\n #2 0x7fe7f15808d7 in ui::SelectFileDialog::SelectFile(ui::SelectFileDialog::Type, std::__1::basic_string > const&, base::FilePath const&, ui::SelectFileDialog::FileTypeInfo const*, int, std::__1::basic_string, std::__1::allocator > const&, aura::Window*, void*) ui/shell_dialogs/select_file_dialog.cc:100:3\n #3 0x7fe7eddd4846 in SavePackageFilePicker::SavePackageFilePicker(content::WebContents*, base::FilePath const&, std::__1::basic_string, std::__1::allocator > const&, bool, DownloadPrefs*, base::Callback const&), (base::internal::CopyMode)1> const&) chrome/browser/download/save_package_file_picker.cc:214:5\n #4 0x7fe7eddc5793 in ChromeDownloadManagerDelegate::ChooseSavePath(content::WebContents*, base::FilePath const&, std::__1::basic_string, std::__1::allocator > const&, bool, base::Callback const&), (base::internal::CopyMode)1> const&) chrome/browser/download/chrome_download_manager_delegate.cc:425:7\n #5 0x7fe7f1fbd856 in content::SavePackage::ContinueGetSaveInfo(base::FilePath const&, bool) content/browser/download/save_package.cc:1473:3\n #6 0x7fe7f1fc67cf in base::internal::Invoker, base::internal::BindState, void (content::SavePackage*, base::FilePath const&, bool), content::SavePackage*, base::FilePath&, bool&>, base::internal::InvokeHelper >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:181:12\n #7 0x7fe7ee11805e in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/callback.h:397:12\n #8 0x7fe7ee0a1723 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:476:3\n #9 0x7fe7ee0a1cbe in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:485:5\n #10 0x7fe7ee0a20a6 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:597:13\n #11 0x7fe7ee1162d8 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:267:7\n #12 0x7fe7ebf0de04 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x48e03)\n #13 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #14 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #15 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #16 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #17 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #18 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #19 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #20 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #21 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #22 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #23 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\nSUMMARY: ThreadSanitizer: heap-use-after-free (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd61be) in __interceptor_memcpy\n==================\n\n+----------------------------------------Release Build Unsymbolized Stacktrace (diff)----------------------------------------+\n\n Mutex M21069 (0x7d0c001878c0) created at:\n #0 0x7fe7eda2dc04 in pthread_mutex_init (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd8c03)\n #1 0x7fe7ebf4f5b8 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x8a5b7)\n #2 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #3 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #4 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #5 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #6 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #7 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #8 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #9 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #10 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #11 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #12 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #13 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Mutex M21097 (0x7d54000a17f0) created at:\n #0 0x7fe7eda4566f in pthread_mutex_lock (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbf066e)\n #1 0x7fe7e9d0de07 in _cairo_scaled_font_freeze_cache /build/buildd/cairo-1.13.0~20140204/src/cairo-scaled-font.c:798\n #2 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #3 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #4 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #5 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #6 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #7 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #8 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #9 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #10 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #11 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #12 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #13 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Mutex M21068 (0x7d7800009028) created at:\n #0 0x7fe7eda2dc04 in pthread_mutex_init (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd8c03)\n #1 0x7fe7e9cd561b in _cairo_device_init /build/buildd/cairo-1.13.0~20140204/src/cairo-device.c:177\n #2 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #3 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #4 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #5 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #6 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #7 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #8 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #9 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #10 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #11 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #12 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #13 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Mutex M20937 (0x7d44000c76d0) created at:\n #0 0x7fe7eda4566f in pthread_mutex_lock (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbf066e)\n #1 0x7fe7e9d5d5b5 in _cairo_ft_unscaled_font_lock_face /build/buildd/cairo-1.13.0~20140204/src/cairo-ft-font.c:649\n #2 0x7fe7f15808d7 in ui::SelectFileDialog::SelectFile(ui::SelectFileDialog::Type, std::__1::basic_string > const&, base::FilePath const&, ui::SelectFileDialog::FileTypeInfo const*, int, std::__1::basic_string, std::__1::allocator > const&, aura::Window*, void*) ui/shell_dialogs/select_file_dialog.cc:100:3\n #3 0x7fe7eddd4846 in SavePackageFilePicker::SavePackageFilePicker(content::WebContents*, base::FilePath const&, std::__1::basic_string, std::__1::allocator > const&, bool, DownloadPrefs*, base::Callback const&), (base::internal::CopyMode)1> const&) chrome/browser/download/save_package_file_picker.cc:214:5\n #4 0x7fe7eddc5793 in ChromeDownloadManagerDelegate::ChooseSavePath(content::WebContents*, base::FilePath const&, std::__1::basic_string, std::__1::allocator > const&, bool, base::Callback const&), (base::internal::CopyMode)1> const&) chrome/browser/download/chrome_download_manager_delegate.cc:425:7\n #5 0x7fe7f1fbd856 in content::SavePackage::ContinueGetSaveInfo(base::FilePath const&, bool) content/browser/download/save_package.cc:1473:3\n #6 0x7fe7f1fc67cf in base::internal::Invoker, base::internal::BindState, void (content::SavePackage*, base::FilePath const&, bool), content::SavePackage*, base::FilePath&, bool&>, base::internal::InvokeHelper >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:181:12\n #7 0x7fe7ee11805e in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/callback.h:397:12\n #8 0x7fe7ee0a1723 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:476:3\n #9 0x7fe7ee0a1cbe in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:485:5\n #10 0x7fe7ee0a20a6 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:597:13\n #11 0x7fe7ee1162d8 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:267:7\n #12 0x7fe7ebf0de04 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x48e03)\n #13 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #14 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #15 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #16 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #17 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #18 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #19 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #20 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #21 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #22 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #23 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\nSUMMARY: ThreadSanitizer: heap-use-after-free (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd61be) in __interceptor_memcpy\n==================\n==================\nWARNING: ThreadSanitizer: heap-use-after-free (pid=26043)\n Read of size 1 at 0x7d08001379d8 by main thread (mutexes: write M21069, write M21097, write M21068, write M20937):\n #0 0x7fe7eda2b1bf in memcpy (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd61be)\n #1 0x7fe7e9d5edae in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:51\n #2 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #3 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #4 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #5 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #6 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #7 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #8 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #9 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #10 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #11 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #12 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #13 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Previous write of size 8 at 0x7d08001379d8 by main thread (mutexes: write M21069, write M21097, write M21068, write M20937):\n #0 0x7fe7eda2adf1 in free (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd5df0)\n #1 0x7fe7ecd659ba in ft_free third_party/freetype2/src/src/base/ftsystem.c:130:5\n #2 0x7fe7ecd660e5 in FT_Load_Glyph third_party/freetype2/src/src/base/ftutil.c:171:7\n #3 0x7fe7e9d5efeb in _cairo_ft_scaled_glyph_init /build/buildd/cairo-1.13.0~20140204/src/cairo-ft-font.c:2249\n #4 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #5 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #6 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #7 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #8 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #9 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #10 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #11 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #12 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #13 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #14 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #15 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Location is heap block of size 24 at 0x7d08001379c0 allocated by main thread:\n #0 0x7fe7eda2a9d5 in malloc (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd59d4)\n #1 0x7fe7ecd6594a in ft_alloc third_party/freetype2/src/src/base/ftsystem.c:74:12\n #2 0x7fe7ecd69f0b in ft_glyphslot_alloc_bitmap third_party/freetype2/src/src/base/ftutil.c:76:15\n #3 0x7fe7ecdbfbf0 in Load_SBit_Image third_party/freetype2/src/src/sfnt/ttsbit.c:1313:15\n #4 0x7fe7ecdbc0a7 in tt_face_load_sbit_image third_party/freetype2/src/src/sfnt/ttsbit.c:1476:13\n #5 0x7fe7ecdc3698 in Load_Glyph third_party/freetype2/src/src/truetype/ttgload.c:1790:13\n #6 0x7fe7ecd6641a in FT_Load_Glyph third_party/freetype2/src/src/base/ftobjs.c:690:15\n #7 0x7fe7e9d5efeb in _cairo_ft_scaled_glyph_init /build/buildd/cairo-1.13.0~20140204/src/cairo-ft-font.c:2249\n #8 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484\n #9 0x7fe7ee0a111c in base::MessageLoop::RunHandler() base/message_loop/message_loop.cc:440:3\n #10 0x7fe7ee0c2967 in base::RunLoop::Run() base/run_loop.cc:35:3\n #11 0x7fe7eddc078c in ChromeBrowserMainParts::MainMessageLoopRun(int*) chrome/browser/chrome_browser_main.cc:1820:3\n #12 0x7fe7f1f415c1 in content::BrowserMainLoop::RunMainMessageLoopParts() content/browser/browser_main_loop.cc:959:21\n #13 0x7fe7f1c36718 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner.cc:152:5\n #14 0x7fe7f1c35df8 in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:44:15\n #15 0x7fe7ee02cf9c in content::RunNamedProcessTypeMain(std::__1::basic_string, std::__1::allocator > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:399:14\n #16 0x7fe7ee02dd12 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:772:12\n #17 0x7fe7ee02bf7f in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:19:15\n #18 0x7fe7eda8a488 in ChromeMain chrome/app/chrome_main.cc:84:12\n #19 0x7fe7eda8a3ff in main chrome/app/chrome_exe_main_aura.cc:17:10\n\n Mutex M21069 (0x7d0c001878c0) created at:\n #0 0x7fe7eda2dc04 in pthread_mutex_init (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-tsan_linux-release_e1f0dbf462d779d5196ef318a224a998657a9c66/revisions/tsan-linux-release-381668/chrome+0xbd8c03)\n #1 0x7fe7ebf4f5b8 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x8a5b7)\n #2 0x7fe7e5c0ff1f in _gdk_window_process_updates_recurse /build/gtk+2.0-KsZSEA/gtk+2.0-2.24.23/gdk/gdkwindow.c:5484 \n", "sanitizer": "ThreadSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_bad_cast_member_call.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_bad_cast_member_call.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_bad_cast_member_call.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_bad_cast_member_call.txt.snap index fb4cd2211f..785582b0a7 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_bad_cast_member_call.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_bad_cast_member_call.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_bad_cast_member_call.txt +--- { "text": "Xlib: extension \"RANDR\" missing on display \":1\".\nXlib: extension \"RANDR\" missing on display \":1\".\nLaunchProcess: failed to execvp:\nxdg-desktop-menu\n../../net/quic/quic_spdy_stream.cc:39:3: runtime error: member call on address 0x15577a7fc900 which does not point to an object of type net::QuicSpdySession\n0x15577a7fc900: note: object is of type net::QuicSession\n 00 00 00 00 38 f7 74 89 0e 7f 00 00 5c 9b 8c 07 fc ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00\n ^~~~~~~~~~~~~~~~~~~~~~~\n vptr for net::QuicSession\n #0 0x7f0e6dace963 in net::QuicSpdyStream::~QuicSpdyStream() net/quic/quic_spdy_stream.cc:39:3\n #1 0x7f0e6e0a05ae in net::QuicChromiumClientStream::~QuicChromiumClientStream() net/quic/quic_chromium_client_stream.cc:31:55\n #2 0x7f0e6de287b0 in STLDeleteContainerPointers<__gnu_cxx::__normal_iterator > > > base/stl_util.h:44:5\n #3 0x7f0e6de287b0 in STLDeleteElements > > base/stl_util.h:135\n #4 0x7f0e6de287b0 in net::QuicSession::~QuicSession() net/quic/quic_session.cc:62\n #5 0x7f0e6e0a7d35 in net::QuicClientSessionBase::~QuicClientSessionBase() net/quic/quic_client_session_base.cc:27:1\n #6 0x7f0e6e07d6bf in net::QuicChromiumClientSession::~QuicChromiumClientSession() net/quic/quic_chromium_client_session.cc:351:1\n #7 0x7f0e6e081d6e in net::QuicChromiumClientSession::~QuicChromiumClientSession() net/quic/quic_chromium_client_session.cc:233:57\n #8 0x7f0e6dafab8f in net::QuicStreamFactory::OnSessionClosed(net::QuicChromiumClientSession*) net/quic/quic_stream_factory.cc:1136:3\n #9 0x7f0e6e09452f in net::QuicChromiumClientSession::NotifyFactoryOfSessionClosed() net/quic/quic_chromium_client_session.cc:1067:5\n #10 0x7f0e6e09fca9 in Run<> base/bind_internal.h:181:12\n #11 0x7f0e6e09fca9 in MakeItSo> base/bind_internal.h:314\n #12 0x7f0e6e09fca9 in base::internal::Invoker, base::internal::BindState, void (net::QuicChromiumClientSession*), base::WeakPtr >, base::internal::InvokeHelper >, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:352\n #13 0x7f0e6c8cb713 in Run base/callback.h:397:12\n #14 0x7f0e6c8cb713 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51\n #15 0x7f0e6c74ee55 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:476:3\n #16 0x7f0e6c75086a in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:485:5\n #17 0x7f0e6c7514b1 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:597:13\n #18 0x7f0e6c6c6a46 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_libevent.cc:229:21\n #19 0x7f0e6c7c65d5 in base::RunLoop::Run() base/run_loop.cc:35:3\n #20 0x7f0e6c74b336 in base::MessageLoop::Run() base/message_loop/message_loop.cc:293:3\n #21 0x7f0e7b2ff184 in content::BrowserThreadImpl::IOThreadRun(base::MessageLoop*) content/browser/browser_thread_impl.cc:215:3\n #22 0x7f0e7b2ffa4e in content::BrowserThreadImpl::Run(base::MessageLoop*) content/browser/browser_thread_impl.cc:251:14\n #23 0x7f0e6c83f390 in base::Thread::ThreadMain() base/threading/thread.cc:254:3\n #24 0x7f0e6c82bef4 in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:68:3\n #25 0x7f0e61070181 in start_thread /build/eglibc-3GlaMS/eglibc-2.19/nptl/pthread_create.c:312\n #26 0x7f0e5fd6b47c in clone /build/eglibc-3GlaMS/eglibc-2.19/sysdeps/unix/sysv/linux/x86_64/clone.S:111\n\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../net/quic/quic_spdy_stream.cc:39:3 in\n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_divide_by_zero.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_divide_by_zero.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_divide_by_zero.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_divide_by_zero.txt.snap index 8b0520c7b1..c3b79a082e 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_divide_by_zero.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_divide_by_zero.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_divide_by_zero.txt +--- { "text": "Running command: /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_ffmpeg_37aaa00c35609bba402b3a13a6024248e52e107c/revisions/ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer -runs=100 -max_len=1000000 -rss_limit_mb=2048 -timeout=25 /dd0311b7a4d3ca938bebbc2a52ee5ec5fb3e37d15e1bfbcf988c8b09702f5c63211fa2628413dc5ce2fec8c0d95a28dfb55cf7f446fd4bc955f5380b58142625dbf163f97a85d7e3c36db6fadb5dd6ec1dec40f3694e53670a9216f2ef6856fbfuzz-3-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer\nINFO: Seed: 3815075981\nINFO: Loaded 1 modules (28863 guards): [0x1290fd0, 0x12ad2cc),\n/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_ffmpeg_37aaa00c35609bba402b3a13a6024248e52e107c/revisions/ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer: Running 1 inputs 100 time(s) each.\nRunning: /dd0311b7a4d3ca938bebbc2a52ee5ec5fb3e37d15e1bfbcf988c8b09702f5c63211fa2628413dc5ce2fec8c0d95a28dfb55cf7f446fd4bc955f5380b58142625dbf163f97a85d7e3c36db6fadb5dd6ec1dec40f3694e53670a9216f2ef6856fbfuzz-3-ffmpeg_AV_CODEC_ID_MPEG1VIDEO_fuzzer\nlibavcodec/mpeg12dec.c:1245:49: runtime error: division by zero\n#0 0x54bf8b in mpeg_decode_postinit /src/ffmpeg/libavcodec/mpeg12dec.c:1245:49\n#1 0x542d2e in decode_chunks /src/ffmpeg/libavcodec/mpeg12dec.c:2536:23\n#2 0x53deca in mpeg_decode_frame /src/ffmpeg/libavcodec/mpeg12dec.c:2826:11\n#3 0x53571c in decode_simple_internal /src/ffmpeg/libavcodec/decode.c:414:15\n#4 0x534f51 in decode_simple_receive_frame /src/ffmpeg/libavcodec/decode.c:617:15\n#5 0x525f72 in decode_receive_frame_internal /src/ffmpeg/libavcodec/decode.c:635:15\n#6 0x524a2d in avcodec_send_packet /src/ffmpeg/libavcodec/decode.c:675:15\n#7 0x5268d3 in compat_decode /src/ffmpeg/libavcodec/decode.c:730:15\n#8 0x5185e7 in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_dec_fuzzer.c:213:23\n#9 0xc2f4b4 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:440:13\n#10 0xc2f7ce in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:397:3\n#11 0xc21ff0 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:268:6\n#12 0xc25f10 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:682:9\n#13 0xc21cec in main /src/libfuzzer/FuzzerMain.cpp:20:10\n#14 0x7f372a45a82f in __libc_start_main /build/glibc-9tT8Do/glibc-2.23/csu/libc-start.c:291\n#15 0x41c908 in _start\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavcodec/mpeg12dec.c:1245:49 in\nMS: 0 ; base unit: 0000000000000000000000000000000000000000\n0x0,0x0,0x1,0xb3,0x0,0x3b,0x0,0x0,0x1,0x0,0x3b,0x28,0x0,0x21,0x1,0x3e,0x0,0x3e,0x0,\n\\x00\\x00\\x01\\xb3\\x00;\\x00\\x00\\x01\\x00;(\\x00!\\x01>\\x00>\\x00\n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_fpe.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_fpe.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_fpe.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_fpe.txt.snap index f4ab5b8fb2..aab626be59 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_fpe.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_fpe.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_fpe.txt +--- { "text": "UndefinedBehaviorSanitizer:DEADLYSIGNAL\n=================================================================\n==13370==ERROR: UndefinedBehaviorSanitizer: FPE on unknown address 0x7fdc48869a7c (pc 0x7fdc48869a7c bp 0x7ffdcfaf8350 sp 0x7ffdcfaf8240 T0)\n #0 0x7fdc48869a7b in ash::WindowGrid::PositionWindows(bool) ash/wm/overview/window_grid.cc:252:49\n #1 0x7fdc487fd825 in ash::WindowSelector::Init(std::vector > const&) ash/wm/overview/window_selector.cc:309:7\n #2 0x7fdc4865e376 in ash::WindowSelectorController::ToggleOverview() ash/wm/overview/window_selector_controller.cc:62:5\n #3 0x7fdc4838639b in HandleToggleOverview ash/accelerators/accelerator_controller.cc:394:3\n #4 0x7fdc4838639b in ash::AcceleratorController::PerformAction(ash::AcceleratorAction, ui::Accelerator const&) ash/accelerators/accelerator_controller.cc:1089\n #5 0x7fdc4838a67d in ash::AcceleratorController::AcceleratorPressed(ui::Accelerator const&) ash/accelerators/accelerator_controller.cc:733:5\n #6 0x7fdc50d8fa5e in ui::AcceleratorManager::Process(ui::Accelerator const&) ui/base/accelerators/accelerator_manager.cc:88:11\n #7 0x7fdc4838186f in ash::AcceleratorController::Process(ui::Accelerator const&) ash/accelerators/accelerator_controller.cc:658:12\n #8 0x7fdc486dcce9 in ash::AcceleratorDelegate::ProcessAccelerator(ui::KeyEvent const&, ui::Accelerator const&, wm::AcceleratorDelegate::KeyType) ash/accelerators/accelerator_delegate.cc:32:5\n #9 0x7fdc4b28c7a3 in wm::AcceleratorFilter::OnKeyEvent(ui::KeyEvent*) ui/wm/core/accelerator_filter.cc:70:7\n #10 0x7fdc50e13d50 in ui::EventHandler::OnEvent(ui::Event*) ui/events/event_handler.cc:37:5\n #11 0x7fdc50e11b4e in DispatchEvent ui/events/event_dispatcher.cc:189:3\n #12 0x7fdc50e11b4e in ui::EventDispatcher::DispatchEventToEventHandlers(std::vector >*, ui::Event*) ui/events/event_dispatcher.cc:168\n #13 0x7fdc50e10256 in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:126:3\n #14 0x7fdc50e0fa70 in DispatchEventToTarget ui/events/event_dispatcher.cc:85:3\n #15 0x7fdc50e0fa70 in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:57\n #16 0x7fdc50e1480b in ui::EventProcessor::OnEventFromSource(ui::Event*) ui/events/event_processor.cc:35:15\n #17 0x7fdc4846d17c in DispatchKeyEventPostIME ash/host/ash_window_tree_host_x11.cc:243:7\n #18 0x7fdc4846d17c in non-virtual thunk to ash::AshWindowTreeHostX11::DispatchKeyEventPostIME(ui::KeyEvent*) ash/host/ash_window_tree_host_x11.cc:239\n #19 0x7fdc5144470f in ui::InputMethodBase::DispatchKeyEventPostIME(ui::KeyEvent*) const ui/base/ime/input_method_base.cc:111:15\n #20 0x7fdc514319d1 in ui::InputMethodChromeOS::ProcessUnfilteredKeyPressEvent(ui::KeyEvent*) ui/base/ime/input_method_chromeos.cc:395:17\n #21 0x7fdc51431297 in ui::InputMethodChromeOS::DispatchKeyEvent(ui::KeyEvent*) ui/base/ime/input_method_chromeos.cc:130:7\n #22 0x7fdc4846f5f9 in ash::InputMethodEventHandler::OnKeyEvent(ui::KeyEvent*) ash/ime/input_method_event_handler.cc:35:3\n #23 0x7fdc50e13d50 in ui::EventHandler::OnEvent(ui::Event*) ui/events/event_handler.cc:37:5\n #24 0x7fdc50e11b4e in DispatchEvent ui/events/event_dispatcher.cc:189:3\n #25 0x7fdc50e11b4e in ui::EventDispatcher::DispatchEventToEventHandlers(std::vector >*, ui::Event*) ui/events/event_dispatcher.cc:168\n #26 0x7fdc50e10256 in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:126:3\n #27 0x7fdc50e0fa70 in DispatchEventToTarget ui/events/event_dispatcher.cc:85:3\n #28 0x7fdc50e0fa70 in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:57\n #29 0x7fdc50e1480b in ui::EventProcessor::OnEventFromSource(ui::Event*) ui/events/event_processor.cc:35:15\n #30 0x7fdc50e1642b in DeliverEventToProcessor ui/events/event_source.cc:73:10\n #31 0x7fdc50e1642b in ui::EventSource::SendEventToProcessor(ui::Event*) ui/events/event_source.cc:51\n #32 0x7fdc5144d04c in aura::WindowTreeHostX11::DispatchEvent(_XEvent* const&) ui/aura/window_tree_host_x11.cc:343:9\n #33 0x7fdc3d35fd47 in ui::PlatformEventSource::DispatchEvent(_XEvent*) ui/events/platform/platform_event_source.cc:82:18\n #34 0x7fdc50ea2348 in ui::X11EventSource::DispatchEvent(_XEvent*) ui/events/platform/x11/x11_event_source.cc:136:21\n #35 0x7fdc50ea1c22 in ExtractCookieDataDispatchEvent ui/events/platform/x11/x11_event_source.cc:129:21\n #36 0x7fdc50ea1c22 in ui::X11EventSource::DispatchXEvents() ui/events/platform/x11/x11_event_source.cc:106\n #37 0x7fdc50ea108a in ui::(anonymous namespace)::XSourceDispatch(_GSource*, int (*)(void*), void*) ui/events/platform/x11/x11_event_source_glib.cc:39:3\n #38 0x7fdc3512bce4 in g_main_context_dispatch\nUndefinedBehaviorSanitizer: can not provide additional info.\nSUMMARY: UndefinedBehaviorSanitizer: FPE (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-asan_linux-release-chromeos_4392242b7f59878a2775b4607420a2b37e17ff13/symbolized/release/asan-linux-release-344814/chrome+0x127f6a7b)\n==13370==ABORTING\n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_ill.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_ill.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_ill.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_ill.txt.snap index 734aff8274..8237c30412 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_ill.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_ill.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_ill.txt +--- { "text": "UndefinedBehaviorSanitizer:DEADLYSIGNAL\n=================================================================\n==89063==ERROR: UndefinedBehaviorSanitizer: ILL on unknown address 0x631000001001 (pc 0x631000001001 bp 0x7ffd2297fd70 sp 0x7ffd2297fd58 T0)\n #0 0x631000001000 ()\n #1 0x4f6b78 in boom_internal() v8/test/fuzzer/wasm-code.cc:76:7\n #2 0x4f6c08 in boom_intermediate() v8/test/fuzzer/wasm-code.cc:83:14\n #3 0x4f6c38 in boom() v8/test/fuzzer/wasm-code.cc:87:7\n #4 0x4f6cd3 in LLVMFuzzerTestOneInput v8/test/fuzzer/wasm-code.cc:100:6\n #5 0x5125bd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:550:13\n #6 0x512aeb in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:501:3\n #7 0x4f7997 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:268:6\n #8 0x4faa80 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:517:9\n #9 0x51a108 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10\n #10 0x7fc7047d7f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287\n\nUndefinedBehaviorSanitizer can not provide additional info.\nSUMMARY: UndefinedBehaviorSanitizer: ILL () \n==89063==ABORTING\n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_incorrect_function_pointer_type.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_incorrect_function_pointer_type.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_incorrect_function_pointer_type.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_incorrect_function_pointer_type.txt.snap index 9b4527c5a5..d5bf109087 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_incorrect_function_pointer_type.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_incorrect_function_pointer_type.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_incorrect_function_pointer_type.txt +--- { "text": "../../ui/gl/gl_implementation.cc:138:18: runtime error: call to function eglGetProcAddress through pointer to incorrect function type void *(*)(const char *)\nthird_party/angle/src/libEGL/libEGL.cpp:287: note: eglGetProcAddress defined here\n#0 0x6adc5c in gl::GetGLProcAddress(char const*) ui/gl/gl_implementation.cc:138:18\n#1 0x6d34f2 in gl::DriverGL::InitializeStaticBindings() ui/gl/gl_bindings_autogen_gl.cc:78:42\n#2 0x6a9891 in gl::InitializeStaticGLBindingsGL() ui/gl/gl_gl_api_implementation.cc:381:15\n#3 0xc1f68b in gl::init::(anonymous namespace)::InitializeStaticEGLInternal() ui/gl/init/gl_initializer_x11.cc:118:3\n#4 0xc1f0a0 in gl::init::InitializeStaticGLBindings(gl::GLImplementation) ui/gl/init/gl_initializer_x11.cc:169:14\n#5 0xc1e94c in gl::init::InitializeGLOneOffImplementation(gl::GLImplementation, bool, bool, bool) ui/gl/init/gl_factory.cc:65:7\n#6 0x53e356 in gpu::(anonymous namespace)::CommandBufferSetup::CommandBufferSetup() gpu/command_buffer/tests/fuzzer_main.cc:105:5\n#7 0x521e5a in __cxx_global_var_init gpu/command_buffer/tests/fuzzer_main.cc:317:35\n#8 0xed9a7c in __libc_csu_init (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-ubsan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-438050/gpu_angle_fuzzer+0xed9a7c)\n#9 0x7f8babe1ae54 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:246\n#10 0x52256c in _start (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-ubsan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-438050/gpu_angle_fuzzer+0x52256c)\n \nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../ui/gl/gl_implementation.cc:138:18 in\n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_index_oob.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_index_oob.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_index_oob.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_index_oob.txt.snap index 912c070e99..584a79bac9 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_index_oob.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_index_oob.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_index_oob.txt +--- { "text": "[27629:27629:0603+/master/docs/linux_suid_sandbox_development.md for more information on developing with the sandbox on.\nXlib: extension \"RANDR\" missing on display \":1\".\nXlib: extension \"RANDR\" missing on display \":1\".\n../../third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_parser_old.cpp:298:3: runtime error: index 256 out of bounds for type uint8_t [256]\n #0 0x7f0fc901002e in CPDF_StreamParser::ParseNextElement() third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_parser_old.cpp:298:28\n #1 0x7f0fc9096213 in CPDF_StreamContentParser::Parse(unsigned char const*, unsigned int, unsigned int) third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_parser.cpp:1533:20\n #2 0x7f0fc9013338 in CPDF_ContentParser::Continue(IFX_Pause*) third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_parser_old.cpp:781:24\n #3 0x7f0fc9001ed8 in CPDF_PageObjectHolder::ContinueParse(IFX_Pause*) third_party/pdfium/core/fpdfapi/fpdf_page/cpdf_pageobjectholder.cpp:28:14\n #4 0x7f0fc92f1dd3 in CPDFXFA_Page::LoadPDFPage() third_party/pdfium/fpdfsdk/fpdfxfa/fpdfxfa_page.cpp:43:17\n #5 0x7f0fc92eb075 in CPDFXFA_Document::GetPage(int) third_party/pdfium/fpdfsdk/fpdfxfa/fpdfxfa_doc.cpp:172:15\n #6 0x7f0fc8f839be in FPDF_GetPageSizeByIndex third_party/pdfium/fpdfsdk/fpdfview.cpp:889:31\n #7 0x7f0fc3574f28 in chrome_pdf::PDFiumEngine::GetPageSize(int) pdf/pdfium/pdfium_engine.cc:2683:12\n #8 0x7f0fc35752b5 in chrome_pdf::PDFiumEngine::LoadPageInfo(bool) pdf/pdfium/pdfium_engine.cc:2569:38\n #9 0x7f0fc3581a92 in chrome_pdf::PDFiumEngine::ContinueLoadingDocument(std::string const&) pdf/pdfium/pdfium_engine.cc:2534:3\n #10 0x7f0fc3575c87 in chrome_pdf::PDFiumEngine::LoadDocument() pdf/pdfium/pdfium_engine.cc:2436:5\n #11 0x7f0fc3591795 in operator() ppapi/utility/completion_callback_factory.h:607:9\n #12 0x7f0fc3591795 in pp::CompletionCallbackFactory::CallbackData::Dispatcher0 >::Thunk(void*, int) ppapi/utility/completion_callback_factory.h:584\n #13 0x7f0fc6bfa460 in PP_RunCompletionCallback ppapi/c/pp_completion_callback.h:240:3\n #14 0x7f0fc6bfa460 in CallWhileUnlocked ppapi/shared_impl/proxy_lock.h:135\n #15 0x7f0fc6bfa460 in ppapi::TrackedCallback::Run(int) ppapi/shared_impl/tracked_callback.cc:141\n #16 0x7f0fc86815f4 in DispatchResourceReply ppapi/proxy/dispatch_reply_message.h:35:3\n #17 0x7f0fc86815f4 in ppapi::proxy::URLLoaderResource::OnReplyReceived(ppapi::proxy::ResourceMessageReplyParams const&, IPC::Message const&) ppapi/proxy/url_loader_resource.cc:249\n #18 0x7f0fc8622fea in ppapi::proxy::PluginMessageFilter::DispatchResourceReply(ppapi::proxy::ResourceMessageReplyParams const&, IPC::Message const&) ppapi/proxy/plugin_message_filter.cc:116:13\n #19 0x7f0fc36572c2 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:21\n #20 0x7f0fc35e02af in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:475:19\n #21 0x7f0fc35e0b69 in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:484:5\n #22 0x7f0fc35e1443 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:601:13\n #23 0x7f0fc35e34c6 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:33:31\n #24 0x7f0fc3606b5c in base::RunLoop::Run() base/run_loop.cc:35:10\n #25 0x7f0fc35df25c in base::MessageLoop::Run() base/message_loop/message_loop.cc:294:12\n #26 0x7f0fc96f64e8 in content::PpapiPluginMain(content::MainFunctionParams const&) content/ppapi_plugin/ppapi_plugin_main.cc:137:21\n #27 0x7f0fc356aad3 in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:345:14\n #28 0x7f0fc356cbdf in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:787:12\n #29 0x7f0fc356a65a in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:20:28\n #30 0x7f0fc2f10889 in ChromeMain chrome/app/chrome_main.cc:84:12\n #31 0x7f0fb6650f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287\n #32 0x7f0fc2ef6ed4 in _start\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../third_party/pdfium/core/fpdfapi/fpdf_page/fpdf_page_parser_old.cpp:298:3 in\n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_integer_overflow_negation.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_integer_overflow_negation.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_integer_overflow_negation.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_integer_overflow_negation.txt.snap index ac358d8d69..6f1801097c 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_integer_overflow_negation.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_integer_overflow_negation.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_integer_overflow_negation.txt +--- { "text": "[26693:26693:0603+/master/docs/linux_suid_sandbox_development.md for more information on developing with the sandbox on.\nXlib: extension \"RANDR\" missing on display \":1\".\nXlib: extension \"RANDR\" missing on display \":1\".\n../../third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp:713:25: runtime error: negation of -2147483648 cannot be represented in type int; cast to an unsigned type to negate this value to itself\n #0 0x7fb8bb6edec2 in blink::CSSSelectorParser::consumeANPlusB(blink::CSSParserTokenRange&, std::pair&) third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp:713:25\n #1 0x7fb8bb6ecec9 in blink::CSSSelectorParser::consumePseudo(blink::CSSParserTokenRange&) third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp:555:18\n #2 0x7fb8bb6eba29 in blink::CSSSelectorParser::consumeSimpleSelector(blink::CSSParserTokenRange&) third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp:348:20\n #3 0x7fb8bb6eae7f in blink::CSSSelectorParser::consumeCompoundSelector(blink::CSSParserTokenRange&) third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp:306:55\n #4 0x7fb8bb6ea6f4 in blink::CSSSelectorParser::consumeComplexSelector(blink::CSSParserTokenRange&) third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp:176:42\n #5 0x7fb8bb6ea24b in blink::CSSSelectorParser::consumeComplexSelectorList(blink::CSSParserTokenRange&) third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp:108:42\n #6 0x7fb8bb6ea181 in blink::CSSSelectorParser::parseSelector(blink::CSSParserTokenRange, blink::CSSParserContext const&, blink::StyleSheetContents*) third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp:91:37\n #7 0x7fb8bb6c53fc in blink::CSSParserImpl::consumeStyleRule(blink::CSSParserTokenRange, blink::CSSParserTokenRange) third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp:685:36\n #8 0x7fb8bb6c0bea in blink::CSSParserImpl::consumeQualifiedRule(blink::CSSParserTokenRange&, blink::CSSParserImpl::AllowedRulesType) third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp:425:16\n #9 0x7fb8bb6c0fd8 in consumeRuleList<(lambda at ../../third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp:173:88)> third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp:340:20\n #10 0x7fb8bb6c0fd8 in blink::CSSParserImpl::parseStyleSheet(WTF::String const&, blink::CSSParserContext const&, blink::StyleSheetContents*) third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp:173\n #11 0x7fb8bb6a8228 in blink::StyleSheetContents::parseStringAtPosition(WTF::String const&, WTF::TextPosition const&) third_party/WebKit/Source/core/css/StyleSheetContents.cpp:366:5\n #12 0x7fb8bb315cf4 in blink::StyleEngine::parseSheet(blink::Element*, WTF::String const&, WTF::TextPosition) third_party/WebKit/Source/core/dom/StyleEngine.cpp:537:29\n #13 0x7fb8bb315a33 in blink::StyleEngine::createSheet(blink::Element*, WTF::String const&, WTF::TextPosition, blink::StyleEngineContext&) third_party/WebKit/Source/core/dom/StyleEngine.cpp:515:22\n #14 0x7fb8bfc0ec0c in blink::StyleElement::createSheet(blink::Element*, WTF::String const&) third_party/WebKit/Source/core/dom/StyleElement.cpp:194:47\n #15 0x7fb8bfc0e485 in blink::StyleElement::process(blink::Element*) third_party/WebKit/Source/core/dom/StyleElement.cpp:141:12\n #16 0x7fb8bfc0e91c in blink::StyleElement::finishParsingChildren(blink::Element*) third_party/WebKit/Source/core/dom/StyleElement.cpp:132:31\n #17 0x7fb8bb47f028 in blink::HTMLStyleElement::finishParsingChildren() third_party/WebKit/Source/core/html/HTMLStyleElement.cpp:75:59\n #18 0x7fb8bb5c37b1 in blink::HTMLElementStack::popCommon() third_party/WebKit/Source/core/html/parser/HTMLElementStack.cpp:573:12\n #19 0x7fb8bb53ab7b in blink::HTMLTreeBuilder::processEndOfFile(blink::AtomicHTMLToken*) third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp:2510:32\n #20 0x7fb8bb533075 in blink::HTMLTreeBuilder::constructTree(blink::AtomicHTMLToken*) third_party/WebKit/Source/core/html/parser/HTMLTreeBuilder.cpp:380:9\n #21 0x7fb8bb4eae86 in blink::HTMLDocumentParser::constructTreeFromCompactHTMLToken(blink::CompactHTMLToken const&) third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:655:20\n #22 0x7fb8bb4ea457 in blink::HTMLDocumentParser::processParsedChunkFromBackgroundParser(WTF::OwnPtr) third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:452:9\n #23 0x7fb8bb4e729f in blink::HTMLDocumentParser::pumpPendingSpeculations() third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:528:36\n #24 0x7fb8bb4fc9ad in void WTF::PartBoundFunctionImpl<(WTF::FunctionThreadAffinity)1, std::tuple&&>, WTF::FunctionWrapper>::callInternal<0ul>(base::IndexSequence<0ul> const&) third_party/WebKit/Source/wtf/Functional.h:350:16\n #25 0x7fb8bb4fc629 in WTF::PartBoundFunctionImpl<(WTF::FunctionThreadAffinity)1, std::tuple&&>, WTF::FunctionWrapper>::operator()() third_party/WebKit/Source/wtf/Functional.h:341:16\n #26 0x7fb8c00fd2bc in void base::internal::RunnableAdapter >)>::Run > >(std::unique_ptr >&&) base/bind_internal.h:160:12\n #27 0x7fb8c00fd25c in MakeItSo >)> &, std::unique_ptr > > base/bind_internal.h:312:38\n #28 0x7fb8c00fd25c in base::internal::Invoker, base::internal::BindState >)>, void (std::unique_ptr >), base::internal::PassedWrapper > > >, false, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:364\n #29 0x7fb8b8cf9702 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:21\n #30 0x7fb8c01075bf in scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(scheduler::internal::WorkQueue*, scheduler::internal::TaskQueueImpl::Task*) components/scheduler/base/task_queue_manager.cc:289:19\n #31 0x7fb8c0105cff in scheduler::TaskQueueManager::DoWork(base::TimeTicks, bool) components/scheduler/base/task_queue_manager.cc:201:13\n #32 0x7fb8c0108a9f in void base::internal::InvokeHelper::MakeItSo&, base::WeakPtr, base::TimeTicks const&, bool const&>(base::internal::RunnableAdapter&, base::WeakPtr, base::TimeTicks const&, bool const&) base/bind_internal.h:325:38\n #33 0x7fb8c0108a00 in base::internal::Invoker, base::internal::BindState, void (scheduler::TaskQueueManager*, base::TimeTicks, bool), base::WeakPtr, base::TimeTicks, bool>, true, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:364:12\n #34 0x7fb8b8cf9702 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51:21\n #35 0x7fb8b8c826ef in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:475:19\n #36 0x7fb8b8c82fa9 in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) base/message_loop/message_loop.cc:484:5\n #37 0x7fb8b8c83883 in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:601:13\n #38 0x7fb8b8c85906 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:33:31\n #39 0x7fb8b8ca8f9c in base::RunLoop::Run() base/run_loop.cc:35:10\n #40 0x7fb8b8c8169c in base::MessageLoop::Run() base/message_loop/message_loop.cc:294:12\n #41 0x7fb8bda0e414 in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:199:37\n #42 0x7fb8b8c0cf13 in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:345:14\n #43 0x7fb8b8c0f01f in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:787:12\n #44 0x7fb8b8c0ca9a in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:20:28\n #45 0x7fb8b85b2cc9 in ChromeMain chrome/app/chrome_main.cc:84:12\n #46 0x7fb8abcedf44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287\n #47 0x7fb8b8599314 in _start\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp:713:25\n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_invalid_bool_value.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_invalid_bool_value.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_invalid_bool_value.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_invalid_bool_value.txt.snap index 2c715ce344..8f2441bc5f 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_invalid_bool_value.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_invalid_bool_value.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_invalid_bool_value.txt +--- { "text": "Running command: /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_libtsm_6d95cdfb4510c2f52e59cdc48fa60dca63fa8045/revisions/libtsm_fuzzer -runs=100 -rss_limit_mb=2048 -timeout=25 /fuzz-3-libtsm_fuzzer\nWARNING: Failed to find function \"__sanitizer_print_stack_trace\".\nINFO: Seed: 2187685998\nINFO: Loaded 1 modules (2806 guards): [0x73e710, 0x7412e8),\n/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_libtsm_6d95cdfb4510c2f52e59cdc48fa60dca63fa8045/revisions/libtsm_fuzzer: Running 1 inputs 100 time(s) each.\nRunning: /fuzz-3-libtsm_fuzzer\nsrc/tsm/tsm-screen.c:1321:8: runtime error: load of value 161, which is not a valid value for type 'bool'\n#0 0x434f6d in tsm_screen_tab_left /src/libtsm/src/tsm/tsm-screen.c:1321:8\n#1 0x438eb7 in parse_data /src/libtsm/src/tsm/tsm-vte.c:0:3\n#2 0x438b19 in tsm_vte_input /src/libtsm/src/tsm/tsm-vte.c:0:4\n#3 0x42e3ad in LLVMFuzzerTestOneInput /src/libtsm_fuzzer.c:44:3\n#4 0x4509d4 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:550:13\n#5 0x450cfa in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:501:3\n#6 0x4451ad in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:268:6\n#7 0x447139 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:517:9\n#8 0x444ebc in main /src/libfuzzer/FuzzerMain.cpp:20:10\n#9 0x7fe78e4ca82f in __libc_start_main\n#10 0x4058f8 in _start\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/tsm/tsm-screen.c:1321:8 in\n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_misaligned_address.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_misaligned_address.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_misaligned_address.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_misaligned_address.txt.snap index d1f3f0ffa2..791fb76373 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_misaligned_address.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_misaligned_address.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_misaligned_address.txt +--- { "text": "Running command: /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_ffmpeg_37aaa00c35609bba402b3a13a6024248e52e107c/revisions/ffmpeg_AV_CODEC_ID_PPM_fuzzer -runs=100 -max_len=1000000 -rss_limit_mb=2048 -timeout=25 /5ccd8674b9a8a541a3291574a282fd047fdbec0fa0dde363db5d6d691dc99884065c2d63672559e11ff1ee7dacfa79467621b1fe711126709e9d1eb50ad263aed461db21926574a35002d1deb963edce5f22ae526033c18a0e25be62345d6f67fuzz-3-ffmpeg_AV_CODEC_ID_PPM_fuzzer\nINFO: Seed: 2608356068\nINFO: Loaded 1 modules (14103 guards): [0xc2cfd0, 0xc3ac2c),\n/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_ffmpeg_37aaa00c35609bba402b3a13a6024248e52e107c/revisions/ffmpeg_AV_CODEC_ID_PPM_fuzzer: Running 1 inputs 100 time(s) each.\nRunning: /5ccd8674b9a8a541a3291574a282fd047fdbec0fa0dde363db5d6d691dc99884065c2d63672559e11ff1ee7dacfa79467621b1fe711126709e9d1eb50ad263aed461db21926574a35002d1deb963edce5f22ae526033c18a0e25be62345d6f67fuzz-3-ffmpeg_AV_CODEC_ID_PPM_fuzzer\nlibavcodec/pnmdec.c:175:25: runtime error: load of misaligned address 0x60600000002b for type uint16_t (aka unsigned short), which requires 2 byte alignment\n0x60600000002b: note: pointer points here\n35 33 36 09 00 00 00 00 01 00 00 00 00 00 27 27 0a 0a 23 27 00 00 00 00 00 00 00 00 00 00 00 00\n^\n#0 0x542682 in pnm_decode_frame /src/ffmpeg/libavcodec/pnmdec.c:175:25\n#1 0x53571c in decode_simple_internal /src/ffmpeg/libavcodec/decode.c:414:15\n#2 0x534f51 in decode_simple_receive_frame /src/ffmpeg/libavcodec/decode.c:617:15\n#3 0x525f72 in decode_receive_frame_internal /src/ffmpeg/libavcodec/decode.c:635:15\n#4 0x524a2d in avcodec_send_packet /src/ffmpeg/libavcodec/decode.c:675:15\n#5 0x5268d3 in compat_decode /src/ffmpeg/libavcodec/decode.c:730:15\n#6 0x5185e7 in LLVMFuzzerTestOneInput /src/ffmpeg/tools/target_dec_fuzzer.c:213:23\n#7 0x79d184 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:440:13\n#8 0x79d49e in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:397:3\n#9 0x78fcc0 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:268:6\n#10 0x793be0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:682:9\n#11 0x78f9bc in main /src/libfuzzer/FuzzerMain.cpp:20:10\n#12 0x7f5fb5e3182f in __libc_start_main /build/glibc-9tT8Do/glibc-2.23/csu/libc-start.c:291\n#13 0x41c908 in _start\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libavcodec/pnmdec.c:175:25 in\nMS: 0 ; base unit: 0000000000000000000000000000000000000000\n0x50,0x35,0x20,0x34,0x20,0x32,0x20,0x35,0x33,0x36,0x9,0x0,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0x0,0x0,0x27,0x27,0xa,0xa,0x23,0x27,0x27,0x27,0x27,0xa,0xa,0x27,0x27,0x27,\nP5 4 2 536\\x09\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x0a\\x0a#\\x0a\\x0a\n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_null_pointer_member_access.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_null_pointer_member_access.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_null_pointer_member_access.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_null_pointer_member_access.txt.snap index b8ab279b1d..c121850549 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_null_pointer_member_access.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_null_pointer_member_access.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_null_pointer_member_access.txt +--- { "text": " Running command: /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_libxml2_ce1b30bbec4a9f82204cba87518d9a199407ecb0/revisions/libxml2_xml_regexp_compile_fuzzer -runs=100 -max_len=4788 -rss_limit_mb=2048 -timeout=25 /7e2ff2bb7024c8ffcbf111aca5aeb7bc22bae3ba753cd6f2f2b51ab2fb7d3312dfdb070e9fa59fccc5ec15b626d5485c8527752c54d58c44f68a4125f9e23e75830c119ba0ce3846b697c5142f8de660d532095f02e2c47c9df22e2e8bf931dbfuzz-2-libxml2_xml_regexp_compile_fuzzer\nINFO: Seed: 3907006728\nINFO: Loaded 0 modules (0 guards):\n/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_libxml2_ce1b30bbec4a9f82204cba87518d9a199407ecb0/revisions/libxml2_xml_regexp_compile_fuzzer: Running 1 inputs 100 time(s) each.\nRunning: /7e2ff2bb7024c8ffcbf111aca5aeb7bc22bae3ba753cd6f2f2b51ab2fb7d3312dfdb070e9fa59fccc5ec15b626d5485c8527752c54d58c44f68a4125f9e23e75830c119ba0ce3846b697c5142f8de660d532095f02e2c47c9df22e2e8bf931dbfuzz-2-libxml2_xml_regexp_compile_fuzzer\nxmlregexp.c:4883:14: runtime error: member access within null pointer of type xmlRegAtom (aka struct _xmlRegAtom)\n#0 0x480c2a in xmlFAParseCharClassEsc /src/libxml2/xmlregexp.c:4883:14\n#1 0x480474 in xmlFAParseAtom /src/libxml2/xmlregexp.c:5299:2\n#2 0x48031d in xmlFAParsePiece /src/libxml2/xmlregexp.c:5316:11\n#3 0x480219 in xmlFAParseBranch /src/libxml2/xmlregexp.c:5342:11\n#4 0x4794ef in xmlFAParseRegExp /src/libxml2/xmlregexp.c:5377:5\n#5 0x479227 in xmlRegexpCompile /src/libxml2/xmlregexp.c:5473:5\n#6 0x42d8ca in LLVMFuzzerTestOneInput /src/libxml2_xml_regexp_compile_fuzzer.cc:29:20\n#7 0x43caed in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:458:13\n#8 0x43cec7 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:397:3\n#9 0x42e008 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:268:6\n#10 0x4324a8 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:683:9\n#11 0x42dc6c in main /src/libfuzzer/FuzzerMain.cpp:20:10\n#12 0x7f051628282f in __libc_start_main /build/glibc-9tT8Do/glibc-2.23/csu/libc-start.c:291\n#13 0x406758 in _start\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior xmlregexp.c:4883:14 in\nMS: 0 ; base unit: 0000000000000000000000000000000000000000\n0x5c,0x50,0x7b,\n\\\\P{\n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_null_pointer_read.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_null_pointer_read.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_null_pointer_read.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_null_pointer_read.txt.snap index aa6c7d03c3..d8bb494529 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_null_pointer_read.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_null_pointer_read.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_null_pointer_read.txt +--- { "text": "Running command: /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_gdal_8f5d9038564387e8bdf28161d9e03f1ffb4dfbad/revisions/shape_fuzzer -runs=100 -max_len=3200 -rss_limit_mb=2048 -timeout=25 /54b7eabbbe749c835671693b6efc8858e74f7a6da9e992c7b540801c43a4675c9a7a02522ec4bd1b53f730ab0e78ead1d4ca085deb5433447c45f7987c782ace5a11624a4f77924f3f7c5c0717967c164a40975f5bb5319115786b590df67b52d1ab06fe330fe0f274497c0e0a631458fuzz-1-gdal_shape_fuzzer\nINFO: Seed: 2268466465\nINFO: Loaded 1 modules (468700 guards): [0x57d8ad0, 0x59a2640),\n/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_gdal_8f5d9038564387e8bdf28161d9e03f1ffb4dfbad/revisions/shape_fuzzer: Running 1 inputs 100 time(s) each.\nRunning: /54b7eabbbe749c835671693b6efc8858e74f7a6da9e992c7b540801c43a4675c9a7a02522ec4bd1b53f730ab0e78ead1d4ca085deb5433447c45f7987c782ace5a11624a4f77924f3f7c5c0717967c164a40975f5bb5319115786b590df67b52d1ab06fe330fe0f274497c0e0a631458fuzz-1-gdal_shape_fuzzer\nshape2ogr.cpp:184:49: runtime error: load of null pointer of type double\n#0 0x1466597 in SHPReadOGRObject(SHPInfo*, int, tagSHPObject*) /src/gdal/gdal/ogr/ogrsf_frmts/shape/shape2ogr.cpp:184:49\n#1 0x14685c7 in SHPReadOGRFeature(SHPInfo*, DBFInfo*, OGRFeatureDefn*, int, tagSHPObject*, char const*) /src/gdal/gdal/ogr/ogrsf_frmts/shape/shape2ogr.cpp:1217:26\n#2 0x1257a83 in OGRShapeLayer::GetNextFeature() /src/gdal/gdal/ogr/ogrsf_frmts/shape/ogrshapelayer.cpp:843:33\n#3 0x4c01ce in OGR_L_GetNextFeature /src/gdal/gdal/ogr/ogrsf_frmts/generic/ogrlayer.cpp:549:48\n#4 0x4392ef in LLVMFuzzerTestOneInput /src/gdal/gdal/fuzzers/shape_fuzzer.cpp:53:32\n#5 0x447dad in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:458:13\n#6 0x448187 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:397:3\n#7 0x439744 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:268:6\n#8 0x43d82b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:683:9\n#9 0x4393cc in main /src/libfuzzer/FuzzerMain.cpp:20:10\n#10 0x7fdf25e7d82f in __libc_start_main /build/glibc-9tT8Do/glibc-2.23/csu/libc-start.c:291\n#11 0x4120d8 in _start\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior shape2ogr.cpp:184:49 in\nMS: 0 ; base unit: 0000000000000000000000000000000000000000", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_null_pointer_reference_binding.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_null_pointer_reference_binding.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_null_pointer_reference_binding.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_null_pointer_reference_binding.txt.snap index 300dc90878..ce7654e085 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_null_pointer_reference_binding.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_null_pointer_reference_binding.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_null_pointer_reference_binding.txt +--- { "text": "Running command: /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_woff2_b3b735e8cc2a2b9b4a095b289dfa25297b5088d2/revisions/convert_woff2ttf_fuzzer -runs=100 -max_len=1000000 -rss_limit_mb=2048 -timeout=25 /19fde25d9ff13e1b974ea33096b77f78ad78665c361a5f98c48723533072eb66ece5a8b20db514e177c99c677546002f3d601daf1aadf58614b6d73aa09fabe3b72c4d04bc8a0a0205eb224f39d47b78dd26861a68a56e93b03d64364719e50cfuzz-3-woff2_convert_woff2ttf_fuzzer\nINFO: Seed: 3894629002\nINFO: Loaded 0 modules (0 guards):\n/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_woff2_b3b735e8cc2a2b9b4a095b289dfa25297b5088d2/revisions/convert_woff2ttf_fuzzer: Running 1 inputs 100 time(s) each.\nRunning: /19fde25d9ff13e1b974ea33096b77f78ad78665c361a5f98c48723533072eb66ece5a8b20db514e177c99c677546002f3d601daf1aadf58614b6d73aa09fabe3b72c4d04bc8a0a0205eb224f39d47b78dd26861a68a56e93b03d64364719e50cfuzz-3-woff2_convert_woff2ttf_fuzzer\n/usr/local/bin/../include/c++/v1/vector:1498:12: runtime error: reference binding to null pointer of type unsigned char\n#0 0x455bd8 in operator[] /usr/local/include/c++/v1/vector:1498:5\n#1 0x455bd8 in woff2::ConvertWOFF2ToTTF(unsigned char const*, unsigned long, woff2::WOFF2Out*) /src/woff2/src/woff2_dec.cc:1302\n#2 0x4557a3 in LLVMFuzzerTestOneInput /src/woff2/src/convert_woff2ttf_fuzzer.cc:11:3\n#3 0x43b80d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:458:13\n#4 0x43bbe7 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:397:3\n#5 0x42cd18 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:268:6\n#6 0x4311b8 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:683:9\n#7 0x42c97c in main /src/libfuzzer/FuzzerMain.cpp:20:10\n#8 0x7f95cd12f82f in __libc_start_main /build/glibc-9tT8Do/glibc-2.23/csu/libc-start.c:291\n#9 0x405848 in _start\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /usr/local/bin/../include/c++/v1/vector:1498:12 in\nMS: 0 ; base unit: 0000000000000000000000000000000000000000\n0x77,0x4f,0x46,0x32,0x0,0x1,0x0,0x0,0x0,0x0,0x0,0x34,0x0,0x1,0x0,0x0,0x0,0x0,0x0,0x1,0x0,0x0,0x0,0x2,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x4f,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x4f,0x0,0x0,0x4f,0x4f,\nwOF2\\x00\\x01\\x00\\x00\\x00\\x00\\x004\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00O\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00O\\x00\\x00OO\n", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_null_pointer_write.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_null_pointer_write.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_null_pointer_write.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_null_pointer_write.txt.snap index b342a08508..85ce228595 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_null_pointer_write.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_null_pointer_write.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_null_pointer_write.txt +--- { "text": "Running command: /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_gdal_8f5d9038564387e8bdf28161d9e03f1ffb4dfbad/revisions/shape_fuzzer -runs=100 -max_len=3200 -rss_limit_mb=2048 -timeout=25 /54b7eabbbe749c835671693b6efc8858e74f7a6da9e992c7b540801c43a4675c9a7a02522ec4bd1b53f730ab0e78ead1d4ca085deb5433447c45f7987c782ace5a11624a4f77924f3f7c5c0717967c164a40975f5bb5319115786b590df67b52d1ab06fe330fe0f274497c0e0a631458fuzz-1-gdal_shape_fuzzer\nINFO: Seed: 2268466465\nINFO: Loaded 1 modules (468700 guards): [0x57d8ad0, 0x59a2640),\n/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_gdal_8f5d9038564387e8bdf28161d9e03f1ffb4dfbad/revisions/shape_fuzzer: Running 1 inputs 100 time(s) each.\nRunning: /54b7eabbbe749c835671693b6efc8858e74f7a6da9e992c7b540801c43a4675c9a7a02522ec4bd1b53f730ab0e78ead1d4ca085deb5433447c45f7987c782ace5a11624a4f77924f3f7c5c0717967c164a40975f5bb5319115786b590df67b52d1ab06fe330fe0f274497c0e0a631458fuzz-1-gdal_shape_fuzzer\nshape2ogr.cpp:184:49: runtime error: store to null pointer of type double\n#0 0x1466597 in SHPReadOGRObject(SHPInfo*, int, tagSHPObject*) /src/gdal/gdal/ogr/ogrsf_frmts/shape/shape2ogr.cpp:184:49\n#1 0x14685c7 in SHPReadOGRFeature(SHPInfo*, DBFInfo*, OGRFeatureDefn*, int, tagSHPObject*, char const*) /src/gdal/gdal/ogr/ogrsf_frmts/shape/shape2ogr.cpp:1217:26\n#2 0x1257a83 in OGRShapeLayer::GetNextFeature() /src/gdal/gdal/ogr/ogrsf_frmts/shape/ogrshapelayer.cpp:843:33\n#3 0x4c01ce in OGR_L_GetNextFeature /src/gdal/gdal/ogr/ogrsf_frmts/generic/ogrlayer.cpp:549:48\n#4 0x4392ef in LLVMFuzzerTestOneInput /src/gdal/gdal/fuzzers/shape_fuzzer.cpp:53:32\n#5 0x447dad in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:458:13\n#6 0x448187 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:397:3\n#7 0x439744 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:268:6\n#8 0x43d82b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:683:9\n#9 0x4393cc in main /src/libfuzzer/FuzzerMain.cpp:20:10\n#10 0x7fdf25e7d82f in __libc_start_main /build/glibc-9tT8Do/glibc-2.23/csu/libc-start.c:291\n#11 0x4120d8 in _start\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior shape2ogr.cpp:184:49 in\nMS: 0 ; base unit: 0000000000000000000000000000000000000000", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_pointer_overflow_null_nonzero_offset.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_pointer_overflow_null_nonzero_offset.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_pointer_overflow_null_nonzero_offset.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_pointer_overflow_null_nonzero_offset.txt.snap index 1eebf3c934..eb397a8475 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_pointer_overflow_null_nonzero_offset.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_pointer_overflow_null_nonzero_offset.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_pointer_overflow_null_nonzero_offset.txt +--- { "text": "Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-711bfa4abfce32eefd009ed5e6aff6ad1df26753\n../../courgette/disassembler_win32.cc:241:44: runtime error: applying non-zero offset 255 to null pointer\n #0 0x56431fe9163e in courgette::DisassemblerWin32::ParseRelocs(std::__1::vector >*) courgette/disassembler_win32.cc:241:44\n #1 0x56431fe91ed9 in courgette::DisassemblerWin32::ExtractAbs32Locations() courgette/disassembler_win32.cc:369:8\n #2 0x56431fe67c67 in courgette::Disassembler::CreateProgram(bool) courgette/disassembler.cc:59:17\n #3 0x56431fe62d5f in courgette::CourgetteFlow::CreateAssemblyProgramFromDisassembler(courgette::CourgetteFlow::Group, bool) courgette/courgette_flow.cc:116:33\n #4 0x56431fcd0e20 in LLVMFuzzerTestOneInput testing/libfuzzer/fuzzers/courgette_fuzzer.cc:17:8\n #5 0x56431fd0c7e6 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:556:15\n #6 0x56431fcf1385 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:292:6\n #7 0x56431fcf4489 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:774:9\n #8 0x56431fd1674a in main third_party/libFuzzer/src/FuzzerMain.cpp:19:10\n #9 0x7f79915ec82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291\n #10 0x56431fcbb829 in _start (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-ubsan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-718607/courgette_fuzzer+0x23d829)\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../courgette/disassembler_win32.cc:241:44 in\nExecuted /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-711bfa4abfce32eefd009ed5e6aff6ad1df26753 in 4395 ms", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_pointer_overflow_null_zero_offset.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_pointer_overflow_null_zero_offset.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_pointer_overflow_null_zero_offset.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_pointer_overflow_null_zero_offset.txt.snap index 35a758097b..ee4d0ad8fe 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_pointer_overflow_null_zero_offset.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_pointer_overflow_null_zero_offset.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_pointer_overflow_null_zero_offset.txt +--- { "text": "Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-1ecd3fd5c9ee4c8545301c3dd5ddc333dbe7360c\n../../third_party/freetype/src/src/cff/cffload.c:2060:51: runtime error: applying zero offset to null pointer\n #0 0x564ca63e03d4 in cff_subfont_load third_party/freetype/src/src/cff/cffload.c:2060:51\n #1 0x564ca63de001 in cff_font_load third_party/freetype/src/src/cff/cffload.c:2374:13\n #2 0x564ca63d2426 in cff_face_init third_party/freetype/src/src/cff/cffobjs.c:615:15\n #3 0x564ca63cdf98 in open_face third_party/freetype/src/src/base/ftobjs.c:1403:15\n #4 0x564ca63c12ad in ft_open_face_internal third_party/freetype/src/src/base/ftobjs.c:2475:19\n #5 0x564ca63c18e1 in FT_New_Memory_Face third_party/freetype/src/src/base/ftobjs.c:1493:12\n #6 0x564ca68d4420 in CFX_Face::New(FT_LibraryRec_*, fxcrt::RetainPtr const&, pdfium::span, long) third_party/pdfium/core/fxge/cfx_face.cpp:15:7\n #7 0x564ca68f4314 in CFX_FontMgr::NewFixedFace(fxcrt::RetainPtr const&, pdfium::span, int) third_party/pdfium/core/fxge/cfx_fontmgr.cpp:151:7\n #8 0x564ca68dea29 in CFX_Font::LoadEmbedded(pdfium::span, bool) third_party/pdfium/core/fxge/cfx_font.cpp:386:47\n #9 0x564ca6c12bc9 in FPDFText_LoadFont third_party/pdfium/fpdfsdk/fpdf_edittext.cpp:493:15\n #10 0x564ca62e7813 in LLVMFuzzerTestOneInput third_party/pdfium/testing/fuzzers/pdf_font_fuzzer.cc:22:23\n #11 0x564ca6323806 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:556:15\n #12 0x564ca63083a5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:292:6\n #13 0x564ca630b4a9 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:774:9\n #14 0x564ca632d87a in main third_party/libFuzzer/src/FuzzerMain.cpp:19:10\n #15 0x7f84246c682f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291\n #16 0x564ca62d2169 in _start (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-ubsan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-718607/pdf_font_fuzzer+0x26c6169)\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../third_party/freetype/src/src/cff/cffload.c:2060:51 in\nExecuted /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-1ecd3fd5c9ee4c8545301c3dd5ddc333dbe7360c in 3782 ms", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_unknown_logs_error.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_unknown_logs_error.txt.snap similarity index 95% rename from src/agent/libclusterfuzz/data/parsed-traces/ubsan_unknown_logs_error.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_unknown_logs_error.txt.snap index 744c42b60d..dcacc5ce36 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/ubsan_unknown_logs_error.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@ubsan_unknown_logs_error.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/ubsan_unknown_logs_error.txt +--- { "text": "Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-1ecd3fd5c9ee4c8545301c3dd5ddc333dbe7360c\n../../third_party/freetype/src/src/cff/cffload.c:2060:51: runtime error: unsupported ubsan error that needs a new signature\n #0 0x564ca63e03d4 in a ../../file:1234:1\n #1 0x564ca63de001 in b ../../file:1234:1\n #2 0x564ca63d2426 in c ../../file:1234:1\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../file:1234:1\nExecuted /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-1ecd3fd5c9ee4c8545301c3dd5ddc333dbe7360c in 1 ms", "sanitizer": "UndefinedBehaviorSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/unknown_module.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@unknown_module.txt.snap similarity index 81% rename from src/agent/libclusterfuzz/data/parsed-traces/unknown_module.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@unknown_module.txt.snap index 644a760bb0..d7f9ca03b2 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/unknown_module.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@unknown_module.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/unknown_module.txt +--- { "text": "==3304==ERROR: AddressSanitizer: access-violation on unknown address 0x0ec3fdec (pc 0x0ec3fdec bp 0x00000000 sp 0x0ec3fde8 T16777215)\n[0624/081056:ERROR:client_util.cc(272)] Could not find exported function RelaunchChromeBrowserWithNewCommandLineIfNeeded\n #0 0xec3fdeb ()\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV ()\n==3304==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/v8_abort_with_source.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_abort_with_source.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/v8_abort_with_source.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_abort_with_source.txt.snap index d92e890ded..3ab22164df 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/v8_abort_with_source.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_abort_with_source.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/v8_abort_with_source.txt +--- { "text": "abort: CSA_ASSERT failed: IsFastElementsKind(LoadElementsKind(array)) [../../src/code-stub-assembler.cc:1567]\n\n\n==== JS stack trace =========================================\n\n 0: ExitFrame [pc: 0x7f2893ca6608]\n 1: StubFrame [pc: 0x7f2893d4f4d4]\n 2: StubFrame [pc: 0x7f2893d69480]\nSecurity context: 0x7e9b3a61aef1 #0#\n 3: sort [0x7e9b3a603799](this=0x7ea84150b091 #1#)\n 4: /* anonymous */ [0x7e9b3a620931] [/mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/clusterfuzz-testcase-5190315991105536.js:16] [bytecode=0x7e9b3a6206e9 offset=489](this=0x7ea841501231 #2#)\n 5: InternalFrame [pc: 0x7f289399716c]\n 6: EntryFrame [pc: 0x7e883e982160]\n\n==== Details ================================================\n\n[0]: ExitFrame [pc: 0x7f2893ca6608]\n[1]: StubFrame [pc: 0x7f2893d4f4d4]\n[2]: StubFrame [pc: 0x7f2893d69480]\n[3]: sort [0x7e9b3a603799](this=0x7ea84150b091 #1#) {\n// optimized frame\n--------- s o u r c e c o d e ---------\n\n-----------------------------------------\n}\n[4]: /* anonymous */ [0x7e9b3a620931] [/mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/clusterfuzz-testcase-5190315991105536.js:16] [bytecode=0x7e9b3a6206e9 offset=489](this=0x7ea841501231 #2#) {\n // expression stack (top to bottom)\n [11] : 0x7ea84150b091 #1#\n [10] : 0\n [09] : 0x7eb11a1004d9 \n [08] : 0x7ea84150b091 #1#\n [07] : 12\n [06] : 0x7e9b3a620479 \n [05] : 0x7ea84150b091 #1#\n [04] : 0x7ea84150b519 #3#\n [03] : 100\n [02] : 0x7ea84150b091 #1#\n [01] : 0x7e9b3a603799 #4#\n [00] : 0x7eb11a1004d9 \n--------- s o u r c e c o d e ---------\no0=[1.1,2.2,3.3];\\x0ao0['push'](undefined,null,'A',NaN,undefined,9.431092e-317);\\x0ao0['push'](undefined,o0,o0,25,'A');\\x0ao0['push'](true,'A',o0);\\x0ao0['push'](o0,undefined,undefined,'A');\\x0ao0['push']('A',o0,o0,11,2.3023e-320);\\x0ao0['push'](o0,undefined,o0,-1,'A',8);\\x0ao0['push'](-1,'A',undefined,Infinity,12);\\x0ao0[...\n\n-----------------------------------------\n}\n\n[5]: InternalFrame [pc: 0x7f289399716c]\n[6]: EntryFrame [pc: 0x7e883e982160]\n==== Key ============================================\n\n #0# 0x7e9b3a61aef1: 0x7e9b3a61aef1 \n #1# 0x7ea84150b091: 0x7ea84150b091 \n #2# 0x7ea841501231: 0x7ea841501231 \n #3# 0x7ea84150b519: 0x7ea84150b519 \n #4# 0x7e9b3a603799: 0x7e9b3a603799 \n=====================\n\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==3195622==ERROR: AddressSanitizer: ILL on unknown address 0x7f28948306d8 (pc 0x7f28948306d8 bp 0x7ffd868ade30 sp 0x7ffd868ade30 T0)\nSCARINESS: 10 (signal)\n #0 0x7f28948306d7 in v8::base::OS::Abort() src/base/platform/platform-posix.cc:395:5\n #1 0x7f2892e7b1c2 in v8::internal::__RT_impl_Runtime_AbortJS(v8::internal::Arguments, v8::internal::Isolate*) src/runtime/runtime-test.cc:702:3\n #2 0x7f2892e79ecb in v8::internal::Runtime_AbortJS(int, v8::internal::Object**, v8::internal::Isolate*) src/runtime/runtime-test.cc:692:1\n #3 0x7f289352235a in v8::internal::Simulator::DoRuntimeCall(v8::internal::Instruction*) src/arm64/simulator-arm64.cc:490:11\n #4 0x7f2893520fa1 in v8::internal::Simulator::ExecuteInstruction() src/arm64/simulator-arm64.h:779:5\n #5 0x7f289351d5c0 in Run src/arm64/simulator-arm64.cc:390:5\n #6 0x7f289351d5c0 in v8::internal::Simulator::CheckPCSComplianceAndRun() src/arm64/simulator-arm64.cc:188\n #7 0x7f289351c5a7 in v8::internal::Simulator::CallImpl(unsigned long, v8::internal::Simulator::CallArgument*) src/arm64/simulator-arm64.cc:157:3\n #8 0x7f2891cfa831 in Call src/arm64/simulator-arm64.h:725:5\n #9 0x7f2891cfa831 in Call src/simulator.h:107\n #10 0x7f2891cfa831 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle, v8::internal::Execution::MessageHandling, v8::internal::Execution::Target) src/execution.cc:154\n #11 0x7f2891cf8997 in v8::internal::(anonymous namespace)::CallInternal(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Execution::MessageHandling, v8::internal::Execution::Target) src/execution.cc:190:10\n #12 0x7f2891cf84a6 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) src/execution.cc:201:10\n #13 0x7f289094c1a4 in v8::Script::Run(v8::Local) src/api.cc:2110:7\n #14 0x55baa2aaf0a6 in v8::Shell::ExecuteString(v8::Isolate*, v8::Local, v8::Local, v8::Shell::PrintResult, v8::Shell::ReportExceptions, v8::Shell::ProcessMessageQueue) src/d8.cc:534:28\n #15 0x55baa2ace56e in v8::SourceGroup::Execute(v8::Isolate*) src/d8.cc:2480:10\n #16 0x55baa2ad5e64 in v8::Shell::RunMain(v8::Isolate*, int, char**, bool) src/d8.cc:2948:34\n #17 0x55baa2ada945 in v8::Shell::Main(int, char**) src/d8.cc:3498:16\n #18 0x7f288d24a82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ILL src/base/platform/platform-posix.cc:395:5 in v8::base::OS::Abort()\n==3195622==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/v8_abort_without_source.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_abort_without_source.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/v8_abort_without_source.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_abort_without_source.txt.snap index 76c4314a19..5ee9f75318 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/v8_abort_without_source.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_abort_without_source.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/v8_abort_without_source.txt +--- { "text": "abort: CSA_ASSERT failed: IsFastElementsKind(LoadElementsKind(array))\n\n\n==== JS stack trace =========================================\n\n 0: ExitFrame [pc: 0x7f2893ca6608]\n 1: StubFrame [pc: 0x7f2893d4f4d4]\n 2: StubFrame [pc: 0x7f2893d69480]\nSecurity context: 0x7e9b3a61aef1 #0#\n 3: sort [0x7e9b3a603799](this=0x7ea84150b091 #1#)\n 4: /* anonymous */ [0x7e9b3a620931] [/mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/clusterfuzz-testcase-5190315991105536.js:16] [bytecode=0x7e9b3a6206e9 offset=489](this=0x7ea841501231 #2#)\n 5: InternalFrame [pc: 0x7f289399716c]\n 6: EntryFrame [pc: 0x7e883e982160]\n\n==== Details ================================================\n\n[0]: ExitFrame [pc: 0x7f2893ca6608]\n[1]: StubFrame [pc: 0x7f2893d4f4d4]\n[2]: StubFrame [pc: 0x7f2893d69480]\n[3]: sort [0x7e9b3a603799](this=0x7ea84150b091 #1#) {\n// optimized frame\n--------- s o u r c e c o d e ---------\n\n-----------------------------------------\n}\n[4]: /* anonymous */ [0x7e9b3a620931] [/mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/clusterfuzz-testcase-5190315991105536.js:16] [bytecode=0x7e9b3a6206e9 offset=489](this=0x7ea841501231 #2#) {\n // expression stack (top to bottom)\n [11] : 0x7ea84150b091 #1#\n [10] : 0\n [09] : 0x7eb11a1004d9 \n [08] : 0x7ea84150b091 #1#\n [07] : 12\n [06] : 0x7e9b3a620479 \n [05] : 0x7ea84150b091 #1#\n [04] : 0x7ea84150b519 #3#\n [03] : 100\n [02] : 0x7ea84150b091 #1#\n [01] : 0x7e9b3a603799 #4#\n [00] : 0x7eb11a1004d9 \n--------- s o u r c e c o d e ---------\no0=[1.1,2.2,3.3];\\x0ao0['push'](undefined,null,'A',NaN,undefined,9.431092e-317);\\x0ao0['push'](undefined,o0,o0,25,'A');\\x0ao0['push'](true,'A',o0);\\x0ao0['push'](o0,undefined,undefined,'A');\\x0ao0['push']('A',o0,o0,11,2.3023e-320);\\x0ao0['push'](o0,undefined,o0,-1,'A',8);\\x0ao0['push'](-1,'A',undefined,Infinity,12);\\x0ao0[...\n\n-----------------------------------------\n}\n\n[5]: InternalFrame [pc: 0x7f289399716c]\n[6]: EntryFrame [pc: 0x7e883e982160]\n==== Key ============================================\n\n #0# 0x7e9b3a61aef1: 0x7e9b3a61aef1 \n #1# 0x7ea84150b091: 0x7ea84150b091 \n #2# 0x7ea841501231: 0x7ea841501231 \n #3# 0x7ea84150b519: 0x7ea84150b519 \n #4# 0x7e9b3a603799: 0x7e9b3a603799 \n=====================\n\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==3195622==ERROR: AddressSanitizer: ILL on unknown address 0x7f28948306d8 (pc 0x7f28948306d8 bp 0x7ffd868ade30 sp 0x7ffd868ade30 T0)\nSCARINESS: 10 (signal)\n #0 0x7f28948306d7 in v8::base::OS::Abort() src/base/platform/platform-posix.cc:395:5\n #1 0x7f2892e7b1c2 in v8::internal::__RT_impl_Runtime_AbortJS(v8::internal::Arguments, v8::internal::Isolate*) src/runtime/runtime-test.cc:702:3\n #2 0x7f2892e79ecb in v8::internal::Runtime_AbortJS(int, v8::internal::Object**, v8::internal::Isolate*) src/runtime/runtime-test.cc:692:1\n #3 0x7f289352235a in v8::internal::Simulator::DoRuntimeCall(v8::internal::Instruction*) src/arm64/simulator-arm64.cc:490:11\n #4 0x7f2893520fa1 in v8::internal::Simulator::ExecuteInstruction() src/arm64/simulator-arm64.h:779:5\n #5 0x7f289351d5c0 in Run src/arm64/simulator-arm64.cc:390:5\n #6 0x7f289351d5c0 in v8::internal::Simulator::CheckPCSComplianceAndRun() src/arm64/simulator-arm64.cc:188\n #7 0x7f289351c5a7 in v8::internal::Simulator::CallImpl(unsigned long, v8::internal::Simulator::CallArgument*) src/arm64/simulator-arm64.cc:157:3\n #8 0x7f2891cfa831 in Call src/arm64/simulator-arm64.h:725:5\n #9 0x7f2891cfa831 in Call src/simulator.h:107\n #10 0x7f2891cfa831 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Handle, v8::internal::Execution::MessageHandling, v8::internal::Execution::Target) src/execution.cc:154\n #11 0x7f2891cf8997 in v8::internal::(anonymous namespace)::CallInternal(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*, v8::internal::Execution::MessageHandling, v8::internal::Execution::Target) src/execution.cc:190:10\n #12 0x7f2891cf84a6 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) src/execution.cc:201:10\n #13 0x7f289094c1a4 in v8::Script::Run(v8::Local) src/api.cc:2110:7\n #14 0x55baa2aaf0a6 in v8::Shell::ExecuteString(v8::Isolate*, v8::Local, v8::Local, v8::Shell::PrintResult, v8::Shell::ReportExceptions, v8::Shell::ProcessMessageQueue) src/d8.cc:534:28\n #15 0x55baa2ace56e in v8::SourceGroup::Execute(v8::Isolate*) src/d8.cc:2480:10\n #16 0x55baa2ad5e64 in v8::Shell::RunMain(v8::Isolate*, int, char**, bool) src/d8.cc:2948:34\n #17 0x55baa2ada945 in v8::Shell::Main(int, char**) src/d8.cc:3498:16\n #18 0x7f288d24a82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ILL src/base/platform/platform-posix.cc:395:5 in v8::base::OS::Abort()\n==3195622==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/v8_check_no_sourcefile.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_check_no_sourcefile.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/v8_check_no_sourcefile.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_check_no_sourcefile.txt.snap index 5f3de17014..65b2f930d2 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/v8_check_no_sourcefile.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_check_no_sourcefile.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/v8_check_no_sourcefile.txt +--- { "text": "[Environment] ASAN_OPTIONS=allow_user_segv_handler=1:exitcode=77:handle_sigtrap=1\n+----------------------------------------Release Build Stacktrace----------------------------------------+\nCommand: /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer -rss_limit_mb=2560 -timeout=60 -runs=100 /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/66c8ed48ba584a9a4278bd8765b22420776a4ec59483586a2b1a93e844f2f87f\nBot: clusterfuzz-linux-bbs1\nTime ran: 0.13105463981628418\nINFO: Seed:726009147\nINFO: Loaded 8 modules (604875 inline 8-bit counters): 26071 [0x7ff8767a7130, 0x7ff8767ad707), 3277 [0x7ff87c6085e6, 0x7ff87c6092b3), 45551 [0x7ff876eb7776, 0x7ff876ec2965), 68591 [0x7ff87792cc86, 0x7ff87793d875), 2250 [0x7ff87c68f016, 0x7ff87c68f8e0), 2143 [0x7ff87c6e8876, 0x7ff87c6e90d5), 447367 [0x7ff87bd45d16, 0x7ff87bdb309d), 9625 [0x562e18e531e8, 0x562e18e55781),\nINFO: Loaded 8 PC tables (604875 PCs): 26071 [0x7ff8767ad708,0x7ff876813478), 3277 [0x7ff87c6092b8,0x7ff87c615f88), 45551 [0x7ff876ec2968,0x7ff876f74858), 68591 [0x7ff87793d878,0x7ff877a49768), 2250 [0x7ff87c68f8e0,0x7ff87c698580), 2143 [0x7ff87c6e90d8,0x7ff87c6f16c8), 447367 [0x7ff87bdb30a0,0x7ff87c486910), 9625 [0x562e18e55788,0x562e18e7b118),\n/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer: Running 1 inputs 100 time(s) each.\nRunning: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/66c8ed48ba584a9a4278bd8765b22420776a4ec59483586a2b1a93e844f2f87f\n#\n# Fatal error in , line 0\n# Check failed: interpreter_result.result() == result_compiled.\n#\n#\n#\n#FailureMessage Object: 0x7ff8722f7460\n==== C stack trace ===============================\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(backtrace+0x5b) [0x562e18b9cbcb]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/libv8_libbase.so(v8::base::debug::StackTrace::StackTrace()+0x2e) [0x7ff87c68489e]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/libv8_libplatform.so(+0x305c2) [0x7ff87c6cb5c2]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/libv8_libbase.so(V8_Fatal(char const*, ...)+0x29e) [0x7ff87c66e1de]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(+0x2dcd6d) [0x562e18d4cd6d]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(+0x2e059b) [0x562e18d5059b]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(+0x19d360) [0x562e18c0d360]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(+0x2a6238) [0x562e18d16238]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(+0x274160) [0x562e18ce4160]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(+0x2813ee) [0x562e18cf13ee]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(main+0xed) [0x562e18d2329d]\n /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0) [0x7ff875535830]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(_start+0x2a) [0x562e18b6632a]\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1450490==ERROR: AddressSanitizer: TRAP on unknown address 0x000000000000 (pc 0x7ff87c68081b bp 0x7ffd59cb1bf0 sp 0x7ffd59cb1be0 T0)\n==1450490==WARNING: invalid path to external symbolizer!\n==1450490==WARNING: Failed to use and restart external symbolizer!\n #0 0x7ff87c68081b in operator() v8/src/base/platform/platform-posix.cc:502:5\n #1 0x7ff87c68081b in v8::base::OS::Abort() v8/src/base/platform/platform-posix.cc:502:5\n #2 0x7ff87c66e200 in V8_Fatal(char const*, ...) v8/src/base/logging.cc:167:3\n #3 0x562e18d4cd6c in v8::internal::wasm::fuzzer::InterpretAndExecuteModule(v8::internal::Isolate*, v8::internal::Handle) v8/test/fuzzer/wasm-fuzzer-common.cc:101:5\n #4 0x562e18d5059a in v8::internal::wasm::fuzzer::WasmExecutionFuzzer::FuzzWasmModule(v8::internal::Vector, bool) v8/test/fuzzer/wasm-fuzzer-common.cc:401:3\n #5 0x562e18c0d35f in LLVMFuzzerTestOneInput v8/test/fuzzer/wasm-compile.cc:1710:23\n #6 0x562e18d16237 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:556:15\n #7 0x562e18ce415f in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:292:6\n #8 0x562e18cf13ed in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:774:9\n #9 0x562e18d2329c in main third_party/libFuzzer/src/FuzzerMain.cpp:19:10\n #10 0x7ff87553582f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/libc-start.c:291\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: TRAP (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/libv8_libbase.so+0x4d81b)\n==1450490==ABORTING\n+----------------------------------------Release Build Unsymbolized Stacktrace (diff)----------------------------------------+\n==1450490==WARNING: invalid path to external symbolizer!\n==1450490==WARNING: Failed to use and restart external symbolizer!\n #0 0x7ff87c68081b (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/libv8_libbase.so+0x4d81b)\n #1 0x7ff87c66e200 (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/libv8_libbase.so+0x3b200)\n #2 0x562e18d4cd6c (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x2dcd6c)\n #3 0x562e18d5059a (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x2e059a)\n #4 0x562e18c0d35f (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x19d35f)\n #5 0x562e18d16237 (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x2a6237)\n #6 0x562e18ce415f (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x27415f)\n #7 0x562e18cf13ed (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x2813ed)\n #8 0x562e18d2329c (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x2b329c)\n #9 0x7ff87553582f (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/v8_check_symbolized.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_check_symbolized.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/v8_check_symbolized.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_check_symbolized.txt.snap index fcf1ce2170..5f60c5ce33 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/v8_check_symbolized.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_check_symbolized.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/v8_check_symbolized.txt +--- { "text": "#\n# Fatal error in ../../src/objects-debug.cc, line 1639\n# Check failed: old_target->kind() == new_target->kind() (3 vs. 16).\n#\n==== C stack trace ===============================\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(backtrace+0x5c)\n[0xf7194e1c]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8_libbase.so(v8::base::debug::StackTrace::StackTrace()+0x38)\n[0xf230f5b8]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8_libplatform.so(+0x125bf)\n[0xf22b85bf]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8_libbase.so(V8_Fatal+0x19a)\n[0xf230001a]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Code::VerifyRecompiledCode(v8::internal::Code*,\nv8::internal::Code*)+0xf7f) [0xf4d120bf]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::SharedFunctionInfo::EnableDeoptimizationSupport(v8::internal::Code*)+0x2f9)\n[0xf4fc7119]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Compiler::EnsureDeoptimizationSupport(v8::internal::CompilationInfo*)+0x12c2)\n[0xf32a84b2]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::compiler::PipelineCompilationJob::PrepareJobImpl()+0x7d7)\n[0xf39658b7]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::CompilationJob::PrepareJob()+0x6f4)\n[0xf3282ed4]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(+0xf77192)\n[0xf3299192]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Compiler::CompileOptimized(v8::internal::Handle,\nv8::internal::Compiler::ConcurrencyMode)+0x30e) [0xf32950be]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(+0x330a23b)\n[0xf562c23b]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Runtime_CompileOptimized_NotConcurrent(int,\nv8::internal::Object**, v8::internal::Isolate*)+0x1f1) [0xf562b251]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Simulator::SoftwareInterrupt(v8::internal::Instruction*)+0xed3)\n[0xf5f916a3]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Simulator::InstructionDecode(v8::internal::Instruction*)+0xe03)\n[0xf5f86133]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Simulator::CallInternal(unsigned\nchar*)+0x455) [0xf5fc6aa5]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Simulator::Call(unsigned\nchar*, int, ...)+0x31b) [0xf5fc7c3b]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(+0x209cce8)\n[0xf43bece8]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(+0x209925e)\n[0xf43bb25e]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Execution::Call(v8::internal::Isolate*,\nv8::internal::Handle,\nv8::internal::Handle, int,\nv8::internal::Handle*)+0x143) [0xf43baa53]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::Script::Run(v8::Local)+0x700)\n[0xf29decb0]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(v8::Shell::ExecuteString(v8::Isolate*,\nv8::Local, v8::Local, bool, bool)+0x33f) [0xf7223bef]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(v8::SourceGroup::Execute(v8::Isolate*)+0x6ec)\n[0xf724de3c]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(v8::Shell::RunMain(v8::Isolate*,\nint, char**, bool)+0x745) [0xf7257835]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(v8::Shell::Main(int,\nchar**)+0x2b77) [0xf725d877]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(main+0x38)\n[0xf725ee58]\n/lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0xf0a7caf3]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(+0x2b502)\n[0xf7147502]\nASAN:DEADLYSIGNAL\n=================================================================\n==19757==ERROR: AddressSanitizer: ILL on unknown address 0xf230afbc (pc\n0xf230afbc bp 0xffc75718 sp 0xffc75700 T0)\nSCARINESS: 10 (signal)\n#0 0xf230afbb in v8::base::OS::Abort()\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/base/platform/platform-posix.cc:261:5\n#1 0xf2300058 in V8_Fatal\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/base/logging.cc:74:3\n#2 0xf4d120be in v8::internal::Code::VerifyRecompiledCode(v8::internal::Code*,\nv8::internal::Code*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/objects-debug.cc:1639:5\n#3 0xf4fc7118 in ReplaceCode\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/objects-inl.h:5927:3\n#4 0xf4fc7118 in\nv8::internal::SharedFunctionInfo::EnableDeoptimizationSupport(v8::internal::Code*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/objects.cc:13637\n#5 0xf32a84b1 in\nv8::internal::Compiler::EnsureDeoptimizationSupport(v8::internal::CompilationInfo*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/compiler.cc:1431:13\n#6 0xf39658b6 in\nv8::internal::compiler::PipelineCompilationJob::PrepareJobImpl()\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/compiler/pipeline.cc:617:10\n#7 0xf3282ed3 in v8::internal::CompilationJob::PrepareJob()\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/compiler.cc:110:22\n#8 0xf3299191 in GetOptimizedCodeNow\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/compiler.cc:782:12\n#9 0xf3299191 in v8::internal::(anonymous\nnamespace)::GetOptimizedCode(v8::internal::Handle,\nv8::internal::Compiler::ConcurrencyMode, v8::internal::BailoutId,\nv8::internal::JavaScriptFrame*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/compiler.cc:971\n#10 0xf32950bd in\nv8::internal::Compiler::CompileOptimized(v8::internal::Handle,\nv8::internal::Compiler::ConcurrencyMode)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/compiler.cc:1290:8\n#11 0xf562c23a in\nv8::internal::__RT_impl_Runtime_CompileOptimized_NotConcurrent(v8::internal::Arguments,\nv8::internal::Isolate*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/runtime/runtime-compiler.cc:64:8\n#12 0xf562b250 in v8::internal::Runtime_CompileOptimized_NotConcurrent(int,\nv8::internal::Object**, v8::internal::Isolate*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/runtime/runtime-compiler.cc:58:1\n#13 0xf5f916a2 in\nv8::internal::Simulator::SoftwareInterrupt(v8::internal::Instruction*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/arm/simulator-arm.cc:1958:13\n#14 0xf5f86132 in DecodeType7\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/arm/simulator-arm.cc:3183:5\n#15 0xf5f86132 in\nv8::internal::Simulator::InstructionDecode(v8::internal::Instruction*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/arm/simulator-arm.cc:5805\n#16 0xf5fc6aa4 in Execute\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/arm/simulator-arm.cc:5832:7\n#17 0xf5fc6aa4 in v8::internal::Simulator::CallInternal(unsigned char*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/arm/simulator-arm.cc:5889\n#18 0xf5fc7c3a in v8::internal::Simulator::Call(unsigned char*, int, ...)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/arm/simulator-arm.cc:5940:3\n#19 0xf43bece7 in v8::internal::(anonymous\nnamespace)::Invoke(v8::internal::Isolate*, bool,\nv8::internal::Handle,\nv8::internal::Handle, int,\nv8::internal::Handle*,\nv8::internal::Handle,\nv8::internal::Execution::MessageHandling)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/execution.cc:145:13\n#20 0xf43bb25d in v8::internal::(anonymous\nnamespace)::CallInternal(v8::internal::Isolate*,\nv8::internal::Handle,\nv8::internal::Handle, int,\nv8::internal::Handle*,\nv8::internal::Execution::MessageHandling)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/execution.cc:181:10\n#21 0xf43baa52 in v8::internal::Execution::Call(v8::internal::Isolate*,\nv8::internal::Handle,\nv8::internal::Handle, int,\nv8::internal::Handle*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/execution.cc:191:10\n#22 0xf29decaf in v8::Script::Run(v8::Local)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/api.cc:2039:7\n#23 0xf7223bee in v8::Shell::ExecuteString(v8::Isolate*, v8::Local,\nv8::Local, bool, bool)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/d8.cc:584:28\n#24 0xf724de3b in v8::SourceGroup::Execute(v8::Isolate*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/d8.cc:2302:10\n#25 0xf7257834 in v8::Shell::RunMain(v8::Isolate*, int, char**, bool)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/d8.cc:2729:34\n#26 0xf725d876 in v8::Shell::Main(int, char**)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/d8.cc:3183:16\n#27 0xf725ee57 in main\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/d8.cc:3218:10\n#28 0xf0a7caf2 in __libc_start_main\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ILL\n(/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8_libbase.so+0x28fbb)\n==19757==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/v8_check_trap.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_check_trap.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/v8_check_trap.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_check_trap.txt.snap index badfaf363e..545ae0545c 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/v8_check_trap.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_check_trap.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/v8_check_trap.txt +--- { "text": "[Environment] ASAN_OPTIONS=allow_user_segv_handler=1:exitcode=77:handle_sigtrap=1\n+----------------------------------------Release Build Stacktrace----------------------------------------+\nCommand: /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer -rss_limit_mb=2560 -timeout=60 -runs=100 /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/66c8ed48ba584a9a4278bd8765b22420776a4ec59483586a2b1a93e844f2f87f\nBot: clusterfuzz-linux-bbs1\nTime ran: 0.13105463981628418\nINFO: Seed:726009147\nINFO: Loaded 8 modules (604875 inline 8-bit counters): 26071 [0x7ff8767a7130, 0x7ff8767ad707), 3277 [0x7ff87c6085e6, 0x7ff87c6092b3), 45551 [0x7ff876eb7776, 0x7ff876ec2965), 68591 [0x7ff87792cc86, 0x7ff87793d875), 2250 [0x7ff87c68f016, 0x7ff87c68f8e0), 2143 [0x7ff87c6e8876, 0x7ff87c6e90d5), 447367 [0x7ff87bd45d16, 0x7ff87bdb309d), 9625 [0x562e18e531e8, 0x562e18e55781),\nINFO: Loaded 8 PC tables (604875 PCs): 26071 [0x7ff8767ad708,0x7ff876813478), 3277 [0x7ff87c6092b8,0x7ff87c615f88), 45551 [0x7ff876ec2968,0x7ff876f74858), 68591 [0x7ff87793d878,0x7ff877a49768), 2250 [0x7ff87c68f8e0,0x7ff87c698580), 2143 [0x7ff87c6e90d8,0x7ff87c6f16c8), 447367 [0x7ff87bdb30a0,0x7ff87c486910), 9625 [0x562e18e55788,0x562e18e7b118),\n/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer: Running 1 inputs 100 time(s) each.\nRunning: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/66c8ed48ba584a9a4278bd8765b22420776a4ec59483586a2b1a93e844f2f87f\n#\n# Fatal error in foo.cc, line 13\n# Check failed: interpreter_result.result() == result_compiled.\n#\n#\n#\n#FailureMessage Object: 0x7ff8722f7460\n==== C stack trace ===============================\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(backtrace+0x5b) [0x562e18b9cbcb]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/libv8_libbase.so(v8::base::debug::StackTrace::StackTrace()+0x2e) [0x7ff87c68489e]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/libv8_libplatform.so(+0x305c2) [0x7ff87c6cb5c2]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/libv8_libbase.so(V8_Fatal(char const*, ...)+0x29e) [0x7ff87c66e1de]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(+0x2dcd6d) [0x562e18d4cd6d]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(+0x2e059b) [0x562e18d5059b]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(+0x19d360) [0x562e18c0d360]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(+0x2a6238) [0x562e18d16238]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(+0x274160) [0x562e18ce4160]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(+0x2813ee) [0x562e18cf13ee]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(main+0xed) [0x562e18d2329d]\n /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0) [0x7ff875535830]\n /mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer(_start+0x2a) [0x562e18b6632a]\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1450490==ERROR: AddressSanitizer: TRAP on unknown address 0x000000000000 (pc 0x7ff87c68081b bp 0x7ffd59cb1bf0 sp 0x7ffd59cb1be0 T0)\n==1450490==WARNING: invalid path to external symbolizer!\n==1450490==WARNING: Failed to use and restart external symbolizer!\n #0 0x7ff87c68081b in operator() v8/src/base/platform/platform-posix.cc:502:5\n #1 0x7ff87c68081b in v8::base::OS::Abort() v8/src/base/platform/platform-posix.cc:502:5\n #2 0x7ff87c66e200 in V8_Fatal(char const*, ...) v8/src/base/logging.cc:167:3\n #3 0x562e18d4cd6c in v8::internal::wasm::fuzzer::InterpretAndExecuteModule(v8::internal::Isolate*, v8::internal::Handle) v8/test/fuzzer/wasm-fuzzer-common.cc:101:5\n #4 0x562e18d5059a in v8::internal::wasm::fuzzer::WasmExecutionFuzzer::FuzzWasmModule(v8::internal::Vector, bool) v8/test/fuzzer/wasm-fuzzer-common.cc:401:3\n #5 0x562e18c0d35f in LLVMFuzzerTestOneInput v8/test/fuzzer/wasm-compile.cc:1710:23\n #6 0x562e18d16237 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:556:15\n #7 0x562e18ce415f in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:292:6\n #8 0x562e18cf13ed in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:774:9\n #9 0x562e18d2329c in main third_party/libFuzzer/src/FuzzerMain.cpp:19:10\n #10 0x7ff87553582f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/libc-start.c:291\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: TRAP (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/libv8_libbase.so+0x4d81b)\n==1450490==ABORTING\n+----------------------------------------Release Build Unsymbolized Stacktrace (diff)----------------------------------------+\n==1450490==WARNING: invalid path to external symbolizer!\n==1450490==WARNING: Failed to use and restart external symbolizer!\n #0 0x7ff87c68081b (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/libv8_libbase.so+0x4d81b)\n #1 0x7ff87c66e200 (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/libv8_libbase.so+0x3b200)\n #2 0x562e18d4cd6c (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x2dcd6c)\n #3 0x562e18d5059a (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x2e059a)\n #4 0x562e18c0d35f (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x19d35f)\n #5 0x562e18d16237 (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x2a6237)\n #6 0x562e18ce415f (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x27415f)\n #7 0x562e18cf13ed (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x2813ed)\n #8 0x562e18d2329c (/mnt/scratch0/clusterfuzz/bot/builds/chromium-browser-libfuzzer_linux-release-asan_ae530a86793cd6b8b56ce9af9159ac101396e802/revisions/libfuzzer-linux-release-873677/v8_wasm_compile_fuzzer+0x2b329c)\n #9 0x7ff87553582f (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/v8_dcheck_symbolized.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_dcheck_symbolized.txt.snap similarity index 98% rename from src/agent/libclusterfuzz/data/parsed-traces/v8_dcheck_symbolized.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_dcheck_symbolized.txt.snap index ebf6384b15..571104987a 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/v8_dcheck_symbolized.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_dcheck_symbolized.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/v8_dcheck_symbolized.txt +--- { "text": "#\n# Fatal error in ../../src/objects-debug.cc, line 1639\n# Debug check failed: old_target->kind() == new_target->kind() (3 vs. 16).\n#\n==== C stack trace ===============================\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(backtrace+0x5c)\n[0xf7194e1c]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8_libbase.so(v8::base::debug::StackTrace::StackTrace()+0x38)\n[0xf230f5b8]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8_libplatform.so(+0x125bf)\n[0xf22b85bf]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8_libbase.so(V8_Fatal+0x19a)\n[0xf230001a]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Code::VerifyRecompiledCode(v8::internal::Code*,\nv8::internal::Code*)+0xf7f) [0xf4d120bf]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::SharedFunctionInfo::EnableDeoptimizationSupport(v8::internal::Code*)+0x2f9)\n[0xf4fc7119]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Compiler::EnsureDeoptimizationSupport(v8::internal::CompilationInfo*)+0x12c2)\n[0xf32a84b2]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::compiler::PipelineCompilationJob::PrepareJobImpl()+0x7d7)\n[0xf39658b7]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::CompilationJob::PrepareJob()+0x6f4)\n[0xf3282ed4]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(+0xf77192)\n[0xf3299192]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Compiler::CompileOptimized(v8::internal::Handle,\nv8::internal::Compiler::ConcurrencyMode)+0x30e) [0xf32950be]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(+0x330a23b)\n[0xf562c23b]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Runtime_CompileOptimized_NotConcurrent(int,\nv8::internal::Object**, v8::internal::Isolate*)+0x1f1) [0xf562b251]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Simulator::SoftwareInterrupt(v8::internal::Instruction*)+0xed3)\n[0xf5f916a3]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Simulator::InstructionDecode(v8::internal::Instruction*)+0xe03)\n[0xf5f86133]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Simulator::CallInternal(unsigned\nchar*)+0x455) [0xf5fc6aa5]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Simulator::Call(unsigned\nchar*, int, ...)+0x31b) [0xf5fc7c3b]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(+0x209cce8)\n[0xf43bece8]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(+0x209925e)\n[0xf43bb25e]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::internal::Execution::Call(v8::internal::Isolate*,\nv8::internal::Handle,\nv8::internal::Handle, int,\nv8::internal::Handle*)+0x143) [0xf43baa53]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8.so(v8::Script::Run(v8::Local)+0x700)\n[0xf29decb0]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(v8::Shell::ExecuteString(v8::Isolate*,\nv8::Local, v8::Local, bool, bool)+0x33f) [0xf7223bef]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(v8::SourceGroup::Execute(v8::Isolate*)+0x6ec)\n[0xf724de3c]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(v8::Shell::RunMain(v8::Isolate*,\nint, char**, bool)+0x745) [0xf7257835]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(v8::Shell::Main(int,\nchar**)+0x2b77) [0xf725d877]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(main+0x38)\n[0xf725ee58]\n/lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0xf0a7caf3]\n/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/d8(+0x2b502)\n[0xf7147502]\nASAN:DEADLYSIGNAL\n=================================================================\n==19757==ERROR: AddressSanitizer: ILL on unknown address 0xf230afbc (pc\n0xf230afbc bp 0xffc75718 sp 0xffc75700 T0)\nSCARINESS: 10 (signal)\n#0 0xf230afbb in v8::base::OS::Abort()\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/base/platform/platform-posix.cc:261:5\n#1 0xf2300058 in V8_Fatal\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/base/logging.cc:74:3\n#2 0xf4d120be in v8::internal::Code::VerifyRecompiledCode(v8::internal::Code*,\nv8::internal::Code*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/objects-debug.cc:1639:5\n#3 0xf4fc7118 in ReplaceCode\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/objects-inl.h:5927:3\n#4 0xf4fc7118 in\nv8::internal::SharedFunctionInfo::EnableDeoptimizationSupport(v8::internal::Code*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/objects.cc:13637\n#5 0xf32a84b1 in\nv8::internal::Compiler::EnsureDeoptimizationSupport(v8::internal::CompilationInfo*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/compiler.cc:1431:13\n#6 0xf39658b6 in\nv8::internal::compiler::PipelineCompilationJob::PrepareJobImpl()\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/compiler/pipeline.cc:617:10\n#7 0xf3282ed3 in v8::internal::CompilationJob::PrepareJob()\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/compiler.cc:110:22\n#8 0xf3299191 in GetOptimizedCodeNow\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/compiler.cc:782:12\n#9 0xf3299191 in v8::internal::(anonymous\nnamespace)::GetOptimizedCode(v8::internal::Handle,\nv8::internal::Compiler::ConcurrencyMode, v8::internal::BailoutId,\nv8::internal::JavaScriptFrame*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/compiler.cc:971\n#10 0xf32950bd in\nv8::internal::Compiler::CompileOptimized(v8::internal::Handle,\nv8::internal::Compiler::ConcurrencyMode)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/compiler.cc:1290:8\n#11 0xf562c23a in\nv8::internal::__RT_impl_Runtime_CompileOptimized_NotConcurrent(v8::internal::Arguments,\nv8::internal::Isolate*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/runtime/runtime-compiler.cc:64:8\n#12 0xf562b250 in v8::internal::Runtime_CompileOptimized_NotConcurrent(int,\nv8::internal::Object**, v8::internal::Isolate*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/runtime/runtime-compiler.cc:58:1\n#13 0xf5f916a2 in\nv8::internal::Simulator::SoftwareInterrupt(v8::internal::Instruction*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/arm/simulator-arm.cc:1958:13\n#14 0xf5f86132 in DecodeType7\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/arm/simulator-arm.cc:3183:5\n#15 0xf5f86132 in\nv8::internal::Simulator::InstructionDecode(v8::internal::Instruction*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/arm/simulator-arm.cc:5805\n#16 0xf5fc6aa4 in Execute\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/arm/simulator-arm.cc:5832:7\n#17 0xf5fc6aa4 in v8::internal::Simulator::CallInternal(unsigned char*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/arm/simulator-arm.cc:5889\n#18 0xf5fc7c3a in v8::internal::Simulator::Call(unsigned char*, int, ...)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/arm/simulator-arm.cc:5940:3\n#19 0xf43bece7 in v8::internal::(anonymous\nnamespace)::Invoke(v8::internal::Isolate*, bool,\nv8::internal::Handle,\nv8::internal::Handle, int,\nv8::internal::Handle*,\nv8::internal::Handle,\nv8::internal::Execution::MessageHandling)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/execution.cc:145:13\n#20 0xf43bb25d in v8::internal::(anonymous\nnamespace)::CallInternal(v8::internal::Isolate*,\nv8::internal::Handle,\nv8::internal::Handle, int,\nv8::internal::Handle*,\nv8::internal::Execution::MessageHandling)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/execution.cc:181:10\n#21 0xf43baa52 in v8::internal::Execution::Call(v8::internal::Isolate*,\nv8::internal::Handle,\nv8::internal::Handle, int,\nv8::internal::Handle*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/execution.cc:191:10\n#22 0xf29decaf in v8::Script::Run(v8::Local)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/api.cc:2039:7\n#23 0xf7223bee in v8::Shell::ExecuteString(v8::Isolate*, v8::Local,\nv8::Local, bool, bool)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/d8.cc:584:28\n#24 0xf724de3b in v8::SourceGroup::Execute(v8::Isolate*)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/d8.cc:2302:10\n#25 0xf7257834 in v8::Shell::RunMain(v8::Isolate*, int, char**, bool)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/d8.cc:2729:34\n#26 0xf725d876 in v8::Shell::Main(int, char**)\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/d8.cc:3183:16\n#27 0xf725ee57 in main\n/b/build/slave/V8_Linux_ASAN_arm_-_debug_builder/build/v8/src/d8.cc:3218:10\n#28 0xf0a7caf2 in __libc_start_main\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ILL\n(/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4eb72ba668f6305da25580be9a07378b8/revisions/d8-arm-asan-linux-debug-v8-component-45504/./libv8_libbase.so+0x28fbb)\n==19757==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/v8_process_oom.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_process_oom.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/v8_process_oom.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_process_oom.txt.snap index 62c2ebe9f2..52b257b869 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/v8_process_oom.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@v8_process_oom.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/v8_process_oom.txt +--- { "text": "[Environment] ASAN_OPTIONS=alloc_dealloc_mismatch=0:allocator_may_return_null=1:allow_user_segv_handler=1:check_malloc_usable_size=0:detect_leaks=1:detect_odr_violation=0:detect_stack_use_after_return=1:external_symbolizer_path=/mnt/scratch0/clusterfuzz/resources/platform/linux/llvm-symbolizer:fast_unwind_on_fatal=1:handle_abort=1:handle_segv=1:handle_sigbus=1:handle_sigfpe=1:handle_sigill=1:handle_sigtrap=1:max_uar_stack_size_log=16:print_scariness=1:print_summary=1:print_suppressions=0:redzone=32:strict_memcmp=0:symbolize=1:symbolize_inline_frames=false:use_sigaltstack=1\n[Command line] /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/d8 --random-seed=-1614433762 --fuzzing --fuzzing --disable-abortjs --disable-in-process-stack-traces --future --no-untrusted-code-mitigations --stress-scavenge=100 --no-enable-sse4_1 --no-wasm-generic-wrapper --turbo-stress-instruction-scheduling --fuzzing /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases-disk/fuzz-27.js\n+----------------------------------------Debug Build Stacktrace----------------------------------------+\n#\n# Fatal error in ../../src/base/small-vector.h, line 162\n# Fatal process out of memory: base::SmallVector::Grow\n#\n#\n#\n#FailureMessage Object: 0xedd6f820\n==== C stack trace ===============================\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/d8(backtrace+0x59) [0x56668d69]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8_libbase.so(v8::base::debug::StackTrace::StackTrace()+0x27) [0xf0613df7]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8_libplatform.so(+0x4667e) [0xf057667e]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8_libbase.so(V8_Fatal(char const*, int, char const*, ...)+0x200) [0xf05e2790]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(+0x4e8bb5a) [0xf54aeb5a]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(v8::base::SmallVector::Grow()+0x1e) [0xf54ae92e]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(bool v8::internal::CompiledReplacement::ParseReplacementPattern(v8::internal::Vector, v8::internal::FixedArray, int, int)+0x10b4) [0xf5443234]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(v8::internal::CompiledReplacement::Compile(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, int)+0x667) [0xf5440e27]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(+0x4e71641) [0xf5494641]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(+0x4e5c7c0) [0xf547f7c0]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(v8::internal::Runtime_RegExpReplaceRT(int, unsigned int*, v8::internal::Isolate*)+0x1ef) [0xf547dd8f]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(+0x179e863) [0xf1dc1863]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(+0x19c9632) [0xf1fec632]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(+0x175ab61) [0xf1d7db61]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(+0x14df2e2) [0xf1b022e2]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(+0x14d7f58) [0xf1afaf58]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(+0x14d7d85) [0xf1afad85]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(+0x29e775b) [0xf300a75b]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*)+0x27a) [0xf3007afa]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so(v8::Script::Run(v8::Local)+0xbf2) [0xf22fcb52]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/d8(v8::Shell::ExecuteString(v8::Isolate*, v8::Local, v8::Local, v8::Shell::PrintResult, v8::Shell::ReportExceptions, v8::Shell::ProcessMessageQueue)+0xdf1) [0x5670fa01]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/d8(v8::SourceGroup::Execute(v8::Isolate*)+0x67a) [0x5676d22a]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/d8(v8::Shell::RunMain(v8::Isolate*, bool)+0x444) [0x56779904]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/d8(v8::Shell::Main(int, char**)+0x2cd1) [0x56782001]\n /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/d8(main+0x1f) [0x56783bbf]\n /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf7) [0xef032637]\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==1939064==ERROR: AddressSanitizer: TRAP on unknown address 0x00000000 (pc 0xf060e8f5 bp 0xff948ff8 sp 0xff948ff0 T0)\nSCARINESS: 10 (signal)\n #0 0xf060e8f5 in v8::base::OS::Abort() src/base/platform/platform-posix.cc:502:5\n #1 0xf05e27b7 in V8_Fatal(char const*, int, char const*, ...) src/base/logging.cc:167:3\n #2 0xf54aeb59 in v8::base::SmallVector::Grow(unsigned int) src/base/small-vector.h:162:7\n #3 0xf54ae92d in v8::base::SmallVector::Grow() src/base/small-vector.h:148:34\n #4 0xf5443233 in bool v8::internal::CompiledReplacement::ParseReplacementPattern(v8::internal::Vector, v8::internal::FixedArray, int, int) src/base/small-vector.h:112:52\n #5 0xf5440e26 in v8::internal::CompiledReplacement::Compile(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, int) src/runtime/runtime-regexp.cc:345:11\n #6 0xf5494640 in v8::internal::(anonymous namespace)::RegExpReplace(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, v8::internal::Handle) src/runtime/runtime-regexp.cc:632:52\n #7 0xf547f7bf in v8::internal::__RT_impl_Runtime_RegExpReplaceRT(v8::internal::Arguments<(v8::internal::ArgumentsType)0>, v8::internal::Isolate*) src/runtime/runtime-regexp.cc:1812:5\n #8 0xf547dd8e in v8::internal::Runtime_RegExpReplaceRT(int, unsigned int*, v8::internal::Isolate*) src/runtime/runtime-regexp.cc:1786:1\n #9 0xf1dc1862 in Builtins_CEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit (/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so+0x179e862)\n #10 0xf1fec631 in Builtins_RegExpReplace (/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so+0x19c9631)\n #11 0xf1d7db60 in Builtins_StringPrototypeReplace (/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so+0x175ab60)\n #12 0xf1b022e1 in Builtins_InterpreterEntryTrampoline (/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so+0x14df2e1)\n #13 0xf1afaf57 in Builtins_JSEntryTrampoline (/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so+0x14d7f57)\n #14 0xf1afad84 in Builtins_JSEntry (/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux32-debug_4b8d2476f1dfb5046c7aba7b6c92fb41b8ab7e80/revisions/d8-asan-linux32-debug-v8-component-74452/libv8.so+0x14d7d84)\n #15 0xf300a75a in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) src/execution/simulator.h:144:12\n #16 0xf3007af9 in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::Handle, v8::internal::Handle, int, v8::internal::Handle*) src/execution/execution.cc:466:10\n #17 0xf22fcb51 in v8::Script::Run(v8::Local) src/api/api.cc:1947:7\n #18 0x5670fa00 in v8::Shell::ExecuteString(v8::Isolate*, v8::Local, v8::Local, v8::Shell::PrintResult, v8::Shell::ReportExceptions, v8::Shell::ProcessMessageQueue) src/d8/d8.cc:717:28\n #19 0x5676d229 in v8::SourceGroup::Execute(v8::Isolate*) src/d8/d8.cc:3592:10\n #20 0x56779903 in v8::Shell::RunMain(v8::Isolate*, bool) src/d8/d8.cc:4245:39\n #21 0x56782000 in v8::Shell::Main(int, char**) src/d8/d8.cc:4967:18\n #22 0x56783bbe in main src/d8/d8.cc:5052:43\n #23 0xef032636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636)\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: TRAP src/base/platform/platform-posix.cc:502:5 in v8::base::OS::Abort()\n==1939064==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/variable_length_write.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@variable_length_write.txt.snap similarity index 96% rename from src/agent/libclusterfuzz/data/parsed-traces/variable_length_write.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@variable_length_write.txt.snap index 9db1ef3ceb..66c74ef5b3 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/variable_length_write.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@variable_length_write.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/variable_length_write.txt +--- { "text": "==51==ERROR: AddressSanitizer: stack-use-after-return on address 0x7f05b02a0000 at pc 0x7f064c658e20 bp 0x7fffc6f420d0 sp 0x7fffc6f41890\nWRITE of size 32780 at 0x7f05b02a0000 thread T0 (chrome)\n #0 0x7f064c658e1f in __asan_memset\n #1 0x7f05d5ad4f3c in SomeFunction(TYPE*, TYPE const&, int) /usr/include/header.h:123\nAddressSanitizer can not describe address in more detail (wild memory access suspected).\nSUMMARY: AddressSanitizer: stack-use-after-return ??:0 ??\nShadow bytes around the buggy address:\n 0x0fe13604bfb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x0fe13604bfc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x0fe13604bfd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x0fe13604bfe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x0fe13604bff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x0fe13604c000:[f5]f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5\n 0x0fe13604c010: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5\n 0x0fe13604c020: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5\n 0x0fe13604c030: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5\n 0x0fe13604c040: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5\n 0x0fe13604c050: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap left redzone: fa\n Heap right redzone: fb\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack partial redzone: f4\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n ASan internal: fe\n==51==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/windows_asan_divide_by_zero.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@windows_asan_divide_by_zero.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/windows_asan_divide_by_zero.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@windows_asan_divide_by_zero.txt.snap index 34512dd763..936766dfff 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/windows_asan_divide_by_zero.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@windows_asan_divide_by_zero.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/windows_asan_divide_by_zero.txt +--- { "text": "==1284==ERROR: AddressSanitizer: int-divide-by-zero on unknown address 0x00000000 (pc 0x16c23cb5 bp 0x0049fcac sp 0x0049fc40 T0)\n==1284==The signal is caused by a READ memory access.\n==1284==Hint: address points to the zero page.\nSCARINESS: 10 (null-deref)\n==1284==*** WARNING: Failed to initialize DbgHelp! ***\n==1284==*** Most likely this means that the app is already ***\n==1284==*** using DbgHelp, possibly with incompatible flags. ***\n==1284==*** Due to technical reasons, symbolization might crash ***\n==1284==*** or produce wrong results. ***\n==1284==WARNING: Failed to use and restart external symbolizer!\n#0 0x16c23cb4 in blink::LayoutMultiColumnSet::PageRemainingLogicalHeightForOffset third_party/WebKit/Source/core/layout/LayoutMultiColumnSet.cpp:146\n#1 0x16abdde7 in blink::LayoutFlowThread::PageRemainingLogicalHeightForOffset third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp:187\n#2 0x169c9374 in blink::LayoutBox::PageRemainingLogicalHeightForOffset third_party/WebKit/Source/core/layout/LayoutBox.cpp:5756\n#3 0x169f5342 in blink::LayoutBlockFlow::AdjustedMarginBeforeForPagination third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:1655\n#4 0x169e926b in blink::LayoutBlockFlow::EstimateLogicalTopPosition third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:2139\n#5 0x169e72de in blink::LayoutBlockFlow::LayoutBlockChild third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:795\n#6 0x169e395e in blink::LayoutBlockFlow::LayoutBlockChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:1505\n#7 0x169dd91c in blink::LayoutBlockFlow::LayoutChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:555\n#8 0x169dc912 in blink::LayoutBlockFlow::UpdateBlockLayout third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:436\n#9 0x16942ebc in blink::LayoutBlock::UpdateLayout third_party/WebKit/Source/core/layout/LayoutBlock.cpp:429\n#10 0x16abcd29 in blink::LayoutFlowThread::UpdateLayout third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp:114\n#11 0x16c10279 in blink::LayoutMultiColumnFlowThread::UpdateLayout third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp:1321\n#12 0x16c08a07 in blink::LayoutMultiColumnFlowThread::LayoutColumns third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp:570\n#13 0x169da2a1 in blink::LayoutBlockFlow::LayoutSpecialExcludedChild third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:274\n#14 0x169e2f8d in blink::LayoutBlockFlow::LayoutBlockChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:1455\n#15 0x169dd91c in blink::LayoutBlockFlow::LayoutChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:555\n#16 0x169dc912 in blink::LayoutBlockFlow::UpdateBlockLayout third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:436\n#17 0x16942ebc in blink::LayoutBlock::UpdateLayout third_party/WebKit/Source/core/layout/LayoutBlock.cpp:429\n#18 0x16a08ddb in blink::LayoutBlockFlow::PositionAndLayoutFloat third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:3790\n#19 0x169f928a in blink::LayoutBlockFlow::PlaceNewFloats third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:3706\n#20 0x16d17aa1 in blink::LineBreaker::SkipLeadingWhitespace third_party/WebKit/Source/core/layout/line/LineBreaker.cpp:48\n#21 0x16d187a3 in blink::LineBreaker::NextLineBreak third_party/WebKit/Source/core/layout/line/LineBreaker.cpp:76\n#22 0x16a7abba in blink::LayoutBlockFlow::LayoutRunsAndFloatsInRange third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp:1153\n#23 0x16a77387 in blink::LayoutBlockFlow::LayoutRunsAndFloats third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp:1033\n#24 0x16a87aa9 in blink::LayoutBlockFlow::LayoutInlineChildren third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp:2021\n#25 0x169dd92d in blink::LayoutBlockFlow::LayoutChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:553\n#26 0x169dc912 in blink::LayoutBlockFlow::UpdateBlockLayout third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:436\n#27 0x16942ebc in blink::LayoutBlock::UpdateLayout third_party/WebKit/Source/core/layout/LayoutBlock.cpp:429\n#28 0x16abcd29 in blink::LayoutFlowThread::UpdateLayout third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp:114\n#29 0x16c10279 in blink::LayoutMultiColumnFlowThread::UpdateLayout third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp:1321\n#30 0x16c08a07 in blink::LayoutMultiColumnFlowThread::LayoutColumns third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp:570\n#31 0x169da2a1 in blink::LayoutBlockFlow::LayoutSpecialExcludedChild third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:274\n#32 0x169e2f8d in blink::LayoutBlockFlow::LayoutBlockChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:1455\n#33 0x169dd91c in blink::LayoutBlockFlow::LayoutChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:555\n#34 0x169dc912 in blink::LayoutBlockFlow::UpdateBlockLayout third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:436\n#35 0x16942ebc in blink::LayoutBlock::UpdateLayout third_party/WebKit/Source/core/layout/LayoutBlock.cpp:429\n#36 0x16a089e2 in blink::LayoutBlockFlow::PositionAndLayoutFloat third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:3756\n#37 0x169f928a in blink::LayoutBlockFlow::PlaceNewFloats third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:3706\n#38 0x16d17aa1 in blink::LineBreaker::SkipLeadingWhitespace third_party/WebKit/Source/core/layout/line/LineBreaker.cpp:48\n#39 0x16d187a3 in blink::LineBreaker::NextLineBreak third_party/WebKit/Source/core/layout/line/LineBreaker.cpp:76\n#40 0x16a7abba in blink::LayoutBlockFlow::LayoutRunsAndFloatsInRange third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp:1153\n#41 0x16a77387 in blink::LayoutBlockFlow::LayoutRunsAndFloats third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp:1033\n#42 0x16a87aa9 in blink::LayoutBlockFlow::LayoutInlineChildren third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp:2021\n#43 0x169dd92d in blink::LayoutBlockFlow::LayoutChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:553\n#44 0x169dc912 in blink::LayoutBlockFlow::UpdateBlockLayout third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:436\n#45 0x16942ebc in blink::LayoutBlock::UpdateLayout third_party/WebKit/Source/core/layout/LayoutBlock.cpp:429\n#46 0x16abcd29 in blink::LayoutFlowThread::UpdateLayout third_party/WebKit/Source/core/layout/LayoutFlowThread.cpp:114\n#47 0x16c10279 in blink::LayoutMultiColumnFlowThread::UpdateLayout third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp:1321\n#48 0x16c08a07 in blink::LayoutMultiColumnFlowThread::LayoutColumns third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp:570\n#49 0x169da2a1 in blink::LayoutBlockFlow::LayoutSpecialExcludedChild third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:274\n#50 0x169e2f8d in blink::LayoutBlockFlow::LayoutBlockChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:1455\n#51 0x169dd91c in blink::LayoutBlockFlow::LayoutChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:555\n#52 0x169dc912 in blink::LayoutBlockFlow::UpdateBlockLayout third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:436\n#53 0x16942ebc in blink::LayoutBlock::UpdateLayout third_party/WebKit/Source/core/layout/LayoutBlock.cpp:429\n#54 0x16a8715e in blink::LayoutBlockFlow::LayoutInlineChildren third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp:2004\n#55 0x169dd92d in blink::LayoutBlockFlow::LayoutChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:553\n#56 0x169dc912 in blink::LayoutBlockFlow::UpdateBlockLayout third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:436\n#57 0x16942ebc in blink::LayoutBlock::UpdateLayout third_party/WebKit/Source/core/layout/LayoutBlock.cpp:429\n#58 0x169e6364 in blink::LayoutBlockFlow::PositionAndLayoutOnceIfNeeded third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:745\n#59 0x169e73f4 in blink::LayoutBlockFlow::LayoutBlockChild third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:808\n#60 0x169e395e in blink::LayoutBlockFlow::LayoutBlockChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:1505\n#61 0x169dd91c in blink::LayoutBlockFlow::LayoutChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:555\n#62 0x169dc912 in blink::LayoutBlockFlow::UpdateBlockLayout third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:436\n#63 0x16942ebc in blink::LayoutBlock::UpdateLayout third_party/WebKit/Source/core/layout/LayoutBlock.cpp:429\n#64 0x169e6364 in blink::LayoutBlockFlow::PositionAndLayoutOnceIfNeeded third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:745\n#65 0x169e73f4 in blink::LayoutBlockFlow::LayoutBlockChild third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:808\n#66 0x169e395e in blink::LayoutBlockFlow::LayoutBlockChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:1505\n#67 0x169dd91c in blink::LayoutBlockFlow::LayoutChildren third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:555\n#68 0x169dc912 in blink::LayoutBlockFlow::UpdateBlockLayout third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp:436\n#69 0x16942ebc in blink::LayoutBlock::UpdateLayout third_party/WebKit/Source/core/layout/LayoutBlock.cpp:429\n#70 0x16c4ac82 in blink::LayoutView::UpdateLayout third_party/WebKit/Source/core/layout/LayoutView.cpp:305\n#71 0x167cf3c9 in blink::FrameView::PerformLayout third_party/WebKit/Source/core/frame/FrameView.cpp:1143\n#72 0x167c8481 in blink::FrameView::UpdateLayout third_party/WebKit/Source/core/frame/FrameView.cpp:1313\n#73 0x167eb259 in blink::FrameView::UpdateStyleAndLayoutIfNeededRecursiveInternal third_party/WebKit/Source/core/frame/FrameView.cpp:3391\n#74 0x167e67e7 in blink::FrameView::UpdateStyleAndLayoutIfNeededRecursive third_party/WebKit/Source/core/frame/FrameView.cpp:3364\n#75 0x167e4006 in blink::FrameView::UpdateLifecyclePhasesInternal third_party/WebKit/Source/core/frame/FrameView.cpp:3105\n#76 0x167e3ddd in blink::FrameView::UpdateAllLifecyclePhases third_party/WebKit/Source/core/frame/FrameView.cpp:2957\n#77 0x16ef631c in blink::PageAnimator::UpdateAllLifecyclePhases third_party/WebKit/Source/core/page/PageAnimator.cpp:100\n#78 0x17405099 in blink::PageWidgetDelegate::UpdateAllLifecyclePhases third_party/WebKit/Source/web/PageWidgetDelegate.cpp:60\n#79 0x1738298b in blink::WebViewImpl::UpdateAllLifecyclePhases third_party/WebKit/Source/web/WebViewImpl.cpp:2030\n#80 0x179f4c40 in content::RenderWidget::UpdateVisualState content/renderer/render_widget.cc:962\n#81 0x15af328b in cc::ProxyMain::BeginMainFrame cc/trees/proxy_main.cc:196\n#82 0x1b5577bc in base::internal::FunctorTraits >) __attribute__((thiscall)),void>::Invoke &,std::unique_ptr > > base/bind_internal.h:214\n#83 0x15b2bcd5 in base::internal::Invoker >) __attribute__((thiscall)),base::WeakPtr,base::internal::PassedWrapper > > >,void ()>::RunOnce base/bind_internal.h:319\n#84 0x12f9b306 in base::debug::TaskAnnotator::RunTask base/debug/task_annotator.cc:57\n#85 0x16656629 in blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:531\n#86 0x16651647 in blink::scheduler::TaskQueueManager::DoWork third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:329\n#87 0x1665fe2c in base::internal::Invoker,bool>,void ()>::Run base/bind_internal.h:340\n#88 0x12f9b306 in base::debug::TaskAnnotator::RunTask base/debug/task_annotator.cc:57\n#89 0x12e473c0 in base::MessageLoop::RunTask base/message_loop/message_loop.cc:404\n#90 0x12e485e0 in base::MessageLoop::DeferOrRunPendingTask base/message_loop/message_loop.cc:415\n#91 0x12e492a6 in base::MessageLoop::DoWork base/message_loop/message_loop.cc:503\n#92 0x12fa18ca in base::MessagePumpDefault::Run base/message_loop/message_pump_default.cc:33\n#93 0x12e463c1 in base::MessageLoop::RunHandler base/message_loop/message_loop.cc:368\n#94 0x12ee23a8 in base::RunLoop::Run base/run_loop.cc:105\n#95 0x17954b78 in content::RendererMain content/renderer/renderer_main.cc:200\n#96 0x12d0969c in content::RunNamedProcessTypeMain content/app/content_main_runner.cc:412\n#97 0x12d0ac8f in content::ContentMainRunnerImpl::Run content/app/content_main_runner.cc:705\n#98 0x12d0cea3 in service_manager::Main services/service_manager/embedder/main.cc:468\n#99 0x12d09380 in content::ContentMain content/app/content_main.cc:19\n#100 0xf971232 in ChromeMain chrome/app/chrome_main.cc:111\n#101 0xd99e95 in MainDllLoader::Launch chrome/app/main_dll_loader_win.cc:202\n#102 0xd91b84 in main chrome/app/chrome_exe_main_win.cc:271\n#103 0x100366a in __scrt_common_main_seh f:\\dd\\vctools\\crt\\vcstartup\\src\\startup\\exe_common.inl:253\n#104 0x767d7c03 in BaseThreadInitThunk+0x23 (C:\\windows\\SYSTEM32\\KERNEL32.DLL+0x17c03)\n#105 0x773fab8e in RtlInitializeExceptionChain+0x8e (C:\\windows\\SYSTEM32\\ntdll.dll+0x5ab8e)\n#106 0x773fab59 in RtlInitializeExceptionChain+0x59 (C:\\windows\\SYSTEM32\\ntdll.dll+0x5ab59)\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: int-divide-by-zero third_party\\WebKit\\Source\\core\\layout\\LayoutMultiColumnSet.cpp:146 in blink::LayoutMultiColumnSet::PageRemainingLogicalHeightForOffset\n==1284==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/libclusterfuzz/data/parsed-traces/wtfcrash.json b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@wtfcrash.txt.snap similarity index 99% rename from src/agent/libclusterfuzz/data/parsed-traces/wtfcrash.json rename to src/agent/libclusterfuzz/data/parsed-traces/check_dir@wtfcrash.txt.snap index b8320b39fb..3c52c48802 100644 --- a/src/agent/libclusterfuzz/data/parsed-traces/wtfcrash.json +++ b/src/agent/libclusterfuzz/data/parsed-traces/check_dir@wtfcrash.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: libclusterfuzz/data/stack-traces/wtfcrash.txt +--- { "text": "AddressSanitizer:DEADLYSIGNAL\n=================================================================\n==22566==ERROR: AddressSanitizer: ILL on unknown address 0x000002ade51c (pc 0x000002ade51c bp 0x7ffd8a3210f0 sp 0x7ffd8a3210f0 T0)\nSCARINESS: 10 (signal)\n#0 0x2ade51b in WTFCrash /src/WebKit/Source/WTF/wtf/Assertions.cpp:271:5\n#1 0x28e6c15 in JSC::BuiltinExecutables::createExecutable(JSC::VM&, JSC::SourceCode const&, JSC::Identifier const&, JSC::ConstructorKind, JSC::ConstructAbility) /src/WebKit/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp:87:9\n#2 0x2917404 in JSC::BuiltinExecutables::typedArrayPrototypeEveryCodeExecutable() /src/WebKit/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp:128:1\n#3 0x25dd7db in JSC::typedArrayPrototypeEveryCodeGenerator(JSC::VM&) /src/WebKit/WebKitBuild/Debug/DerivedSources/JavaScriptCore/JSCBuiltins.cpp:4410:1\n#4 0x21aade1 in JSC::JSTypedArrayViewPrototype::finishCreation(JSC::VM&, JSC::JSGlobalObject*) /src/WebKit/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp:304:5\n#5 0x21af2a0 in JSC::JSTypedArrayViewPrototype::create(JSC::VM&, JSC::JSGlobalObject*, JSC::Structure*) /src/WebKit/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp:346:16\n#6 0x2105009 in JSC::JSGlobalObject::init(JSC::VM&)::$_10::operator()(JSC::LazyProperty::Initializer const&) const /src/WebKit/Source/JavaScriptCore/runtime/JSGlobalObject.cpp:468:22\n#7 0x2104e3a in JSC::JSTypedArrayViewPrototype* JSC::LazyProperty::callFunc(JSC::LazyProperty::Initializer const&) /src/WebKit/Source/JavaScriptCore/runtime/LazyPropertyInlines.h:98:5\n#8 0x212857c in JSC::LazyProperty::get(JSC::JSGlobalObject const*) const /src/WebKit/Source/JavaScriptCore/runtime/LazyProperty.h:84:20\n#9 0x21097bf in JSC::JSGlobalObject::init(JSC::VM&)::$_18::operator()(JSC::LazyClassStructure::Initializer&) const /src/WebKit/Source/JavaScriptCore/runtime/JSGlobalObject.cpp:489:5\n#10 0x210960b in void JSC::LazyClassStructure::initLater(JSC::JSGlobalObject::init(JSC::VM&)::$_18 const&)::{lambda(JSC::LazyProperty::Initializer const&)#1}::operator()(JSC::LazyProperty::Initializer const&) const /src/WebKit/Source/JavaScriptCore/runtime/LazyClassStructureInlines.h:42:13\n#11 0x210942a in JSC::Structure* JSC::LazyProperty::callFunc(JSC::JSGlobalObject::init(JSC::VM&)::$_18 const&)::{lambda(JSC::LazyProperty::Initializer const&)#1}>(JSC::LazyProperty::Initializer const&) /src/WebKit/Source/JavaScriptCore/runtime/LazyPropertyInlines.h:98:5\n#12 0x132853c in JSC::LazyProperty::get(JSC::JSGlobalObject const*) const /src/WebKit/Source/JavaScriptCore/runtime/LazyProperty.h:84:20\n#13 0x216cbba in JSC::reifyStaticProperty(JSC::VM&, JSC::ClassInfo const*, JSC::PropertyName const&, JSC::HashTableValue const&, JSC::JSObject&) /src/WebKit/Source/JavaScriptCore/runtime/Lookup.h:366:20\n#14 0x22163a5 in JSC::setUpStaticFunctionSlot(JSC::VM&, JSC::ClassInfo const*, JSC::HashTableValue const*, JSC::JSObject*, JSC::PropertyName, JSC::PropertySlot&) /src/WebKit/Source/JavaScriptCore/runtime/Lookup.cpp:62:9\n#15 0x215b61c in JSC::JSObject::getOwnStaticPropertySlot(JSC::VM&, JSC::PropertyName, JSC::PropertySlot&) /src/WebKit/Source/JavaScriptCore/runtime/JSObject.cpp:2028:17\n#16 0x1342949 in JSC::JSObject::getOwnNonIndexPropertySlot(JSC::VM&, JSC::Structure*, JSC::PropertyName, JSC::PropertySlot&) /src/WebKit/Source/JavaScriptCore/runtime/JSObject.h:1329:16\n#17 0x13426a9 in JSC::JSObject::getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) /src/WebKit/Source/JavaScriptCore/runtime/JSObject.h:1380:17\n#18 0x20ddf67 in JSC::JSGlobalObject::getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) /src/WebKit/Source/JavaScriptCore/runtime/JSGlobalObject.cpp:1409:9\n#19 0x2183b83 in JSC::abstractAccess(JSC::ExecState*, JSC::JSScope*, JSC::Identifier const&, JSC::GetOrPut, unsigned long, bool&, JSC::ResolveOp&, JSC::InitializationMode) /src/WebKit/Source/JavaScriptCore/runtime/JSScope.cpp:156:31\n#20 0x2182dea in JSC::JSScope::abstractResolve(JSC::ExecState*, unsigned long, JSC::JSScope*, JSC::Identifier const&, JSC::GetOrPut, JSC::ResolveType, JSC::InitializationMode) /src/WebKit/Source/JavaScriptCore/runtime/JSScope.cpp:312:24\n#21 0x13de75e in JSC::CodeBlock::finishCreation(JSC::VM&, JSC::ScriptExecutable*, JSC::UnlinkedCodeBlock*, JSC::JSScope*) /src/WebKit/Source/JavaScriptCore/bytecode/CodeBlock.cpp:636:28\n#22 0x22b76a4 in JSC::FunctionCodeBlock::create(JSC::VM*, JSC::FunctionExecutable*, JSC::UnlinkedFunctionCodeBlock*, JSC::JSScope*, WTF::RefPtr&&, unsigned int, unsigned int) /src/WebKit/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h:55:24\n#23 0x22aee53 in JSC::ScriptExecutable::newCodeBlockFor(JSC::CodeSpecializationKind, JSC::JSFunction*, JSC::JSScope*, JSC::JSObject*&) /src/WebKit/Source/JavaScriptCore/runtime/ScriptExecutable.cpp:259:12\n#24 0x22af8d7 in JSC::ScriptExecutable::prepareForExecutionImpl(JSC::VM&, JSC::JSFunction*, JSC::JSScope*, JSC::CodeSpecializationKind, JSC::CodeBlock*&) /src/WebKit/Source/JavaScriptCore/runtime/ScriptExecutable.cpp:339:28\n#25 0x1def053 in JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) /src/WebKit/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1398:47\n#26 0x1dee5df in JSC::LLInt::genericCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind) /src/WebKit/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1449:12\n#27 0x1de7655 in llint_slow_path_call /src/WebKit/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1456:12\n#28 0x1dd59b3 in jsc\n#29 0x7fab96bcce6e ()\n#30 0x7fab96bccb8f ()\n#31 0x7fab96bccb8f ()\n#32 0x7fab96bccb8f ()\n#33 0x7fab96bccb8f ()\n#34 0x7fab96bccb8f ()\n#35 0x7fab96bccb8f ()\n#36 0x7fab96bccb8f ()\n#37 0x7fab96bccb8f ()\n#38 0x7fab96bccb8f ()\n#39 0x7fab96bccb8f ()\n#40 0x7fab96bccb8f ()\n#41 0x7fab96bccb8f ()\n#42 0x7fab96bccb8f ()\n#43 0x7fab96bccb8f ()\n#44 0x7fab96bccb8f ()\n#45 0x7fab96bccb8f ()\n#46 0x7fab96bccb8f ()\n#47 0x7fab96bccb8f ()\n#48 0x7fab96bccb8f ()\n#49 0x7fab96bccb8f ()\n#50 0x7fab96bccb8f ()\n#51 0x7fab96bccb8f ()\n#52 0x7fab96bccb8f ()\n#53 0x7fab96bccb8f ()\n#54 0x7fab96bccb8f ()\n#55 0x7fab96bccb8f ()\n#56 0x7fab96bccb8f ()\n#57 0x7fab96bccb8f ()\n#58 0x7fab96bccb8f ()\n#59 0x7fab96bccb8f ()\n#60 0x7fab96bccb8f ()\n#61 0x7fab96bccb8f ()\n#62 0x7fab96bccb8f ()\n#63 0x7fab96bccb8f ()\n#64 0x7fab96bccb8f ()\n#65 0x7fab96bccb8f ()\n#66 0x7fab96bccb8f ()\n#67 0x7fab96bccb8f ()\n#68 0x7fab96bccb8f ()\n#69 0x7fab96bccb8f ()\n#70 0x7fab96bccb8f ()\n#71 0x7fab96bccb8f ()\n#72 0x7fab96bccb8f ()\n#73 0x7fab96bccb8f ()\n#74 0x7fab96bccb8f ()\n#75 0x7fab96bccb8f ()\n#76 0x7fab96bccb8f ()\n#77 0x7fab96bccb8f ()\n#78 0x7fab96bccb8f ()\n#79 0x7fab96bccb8f ()\n#80 0x7fab96bccb8f ()\n#81 0x7fab96bccb8f ()\n#82 0x7fab96bccb8f ()\n#83 0x7fab96bccb8f ()\n#84 0x7fab96bccb8f ()\n#85 0x7fab96bccb8f ()\n#86 0x7fab96bccb8f ()\n#87 0x7fab96bccb8f ()\n#88 0x7fab96bccb8f ()\n#89 0x7fab96bccb8f ()\n#90 0x7fab96bccb8f ()\n#91 0x7fab96bccb8f ()\n#92 0x7fab96bccb8f ()\n#93 0x7fab96bccb8f ()\n#94 0x7fab96bccb8f ()\n#95 0x7fab96bccb8f ()\n#96 0x7fab96bccb8f ()\n#97 0x7fab96bccb8f ()\n#98 0x7fab96bccb8f ()\n#99 0x7fab96bccb8f ()\n#100 0x7fab96bccb8f ()\n#101 0x7fab96bccb8f ()\n#102 0x7fab96bccb8f ()\n#103 0x7fab96bccb8f ()\n#104 0x7fab96bccb8f ()\n#105 0x7fab96bccb8f ()\n#106 0x7fab96bccb8f ()\n#107 0x7fab96bccb8f ()\n#108 0x7fab96bccb8f ()\n#109 0x7fab96bccb8f ()\n#110 0x7fab96bccb8f ()\n#111 0x7fab96bccb8f ()\n#112 0x7fab96bccb8f ()\n#113 0x7fab96bccb8f ()\n#114 0x7fab96bccb8f ()\n#115 0x7fab96bccb8f ()\n#116 0x7fab96bccb8f ()\n#117 0x7fab96bccb8f ()\n#118 0x7fab96bccb8f ()\n#119 0x7fab96bccb8f ()\n#120 0x7fab96bccb8f ()\n#121 0x7fab96bccb8f ()\n#122 0x7fab96bccb8f ()\n#123 0x7fab96bccb8f ()\n#124 0x7fab96bccb8f ()\n#125 0x7fab96bccb8f ()\n#126 0x7fab96bccb8f ()\n#127 0x7fab96bccb8f ()\n#128 0x7fab96bccb8f ()\n#129 0x7fab96bccb8f ()\n#130 0x7fab96bccb8f ()\n#131 0x7fab96bccb8f ()\n#132 0x7fab96bccb8f ()\n#133 0x7fab96bccb8f ()\n#134 0x7fab96bccb8f ()\n#135 0x7fab96bccb8f ()\n#136 0x7fab96bccb8f ()\n#137 0x7fab96bccb8f ()\n#138 0x7fab96bccb8f ()\n#139 0x7fab96bccb8f ()\n#140 0x7fab96bccb8f ()\n#141 0x7fab96bccb8f ()\n#142 0x7fab96bccb8f ()\n#143 0x7fab96bccb8f ()\n#144 0x7fab96bccb8f ()\n#145 0x7fab96bccb8f ()\n#146 0x7fab96bccb8f ()\n#147 0x7fab96bccb8f ()\n#148 0x7fab96bccb8f ()\n#149 0x7fab96bccb8f ()\n#150 0x7fab96bccb8f ()\n#151 0x7fab96bccb8f ()\n#152 0x7fab96bccb8f ()\n#153 0x7fab96bccb8f ()\n#154 0x7fab96bccb8f ()\n#155 0x7fab96bccb8f ()\n#156 0x7fab96bccb8f ()\n#157 0x7fab96bccb8f ()\n#158 0x7fab96bccb8f ()\n#159 0x7fab96bccb8f ()\n#160 0x7fab96bccb8f ()\n#161 0x7fab96bccb8f ()\n#162 0x7fab96bccb8f ()\n#163 0x7fab96bccb8f ()\n#164 0x7fab96bccb8f ()\n#165 0x7fab96bccb8f ()\n#166 0x7fab96bccb8f ()\n#167 0x7fab96bccb8f ()\n#168 0x7fab96bccb8f ()\n#169 0x7fab96bccb8f ()\n#170 0x7fab96bccb8f ()\n#171 0x7fab96bccb8f ()\n#172 0x7fab96bccb8f ()\n#173 0x7fab96bccb8f ()\n#174 0x7fab96bccb8f ()\n#175 0x7fab96bccb8f ()\n#176 0x7fab96bccb8f ()\n#177 0x7fab96bccb8f ()\n#178 0x7fab96bccb8f ()\n#179 0x7fab96bccb8f ()\n#180 0x7fab96bccb8f ()\n#181 0x7fab96bccb8f ()\n#182 0x7fab96bccb8f ()\n#183 0x7fab96bccb8f ()\n#184 0x7fab96bccb8f ()\n#185 0x7fab96bccb8f ()\n#186 0x7fab96bccb8f ()\n#187 0x7fab96bccb8f ()\n#188 0x7fab96bccb8f ()\n#189 0x7fab96bccb8f ()\n#190 0x7fab96bccb8f ()\n#191 0x7fab96bccb8f ()\n#192 0x7fab96bccb8f ()\n#193 0x7fab96bccb8f ()\n#194 0x7fab96bccb8f ()\n#195 0x7fab96bccb8f ()\n#196 0x7fab96bccb8f ()\n#197 0x7fab96bccb8f ()\n#198 0x7fab96bccb8f ()\n#199 0x7fab96bccb8f ()\n#200 0x7fab96bccb8f ()\n#201 0x7fab96bccb8f ()\n#202 0x7fab96bccb8f ()\n#203 0x7fab96bccb8f ()\n#204 0x7fab96bccb8f ()\n#205 0x7fab96bccb8f ()\n#206 0x7fab96bccb8f ()\n#207 0x7fab96bccb8f ()\n#208 0x7fab96bccb8f ()\n#209 0x7fab96bccb8f ()\n#210 0x7fab96bccb8f ()\n#211 0x7fab96bccb8f ()\n#212 0x7fab96bccb8f ()\n#213 0x7fab96bccb8f ()\n#214 0x7fab96bccb8f ()\n#215 0x7fab96bccb8f ()\n#216 0x7fab96bccb8f ()\n#217 0x7fab96bccb8f ()\n#218 0x7fab96bccb8f ()\n#219 0x7fab96bccb8f ()\n#220 0x7fab96bccb8f ()\n#221 0x7fab96bccb8f ()\n#222 0x7fab96bccb8f ()\n#223 0x7fab96bccb8f ()\n#224 0x7fab96bccb8f ()\n#225 0x7fab96bccb8f ()\n#226 0x7fab96bccb8f ()\n#227 0x7fab96bccb8f ()\n#228 0x7fab96bccb8f ()\n#229 0x7fab96bccb8f ()\n#230 0x7fab96bccb8f ()\n#231 0x7fab96bccb8f ()\n#232 0x7fab96bccb8f ()\n#233 0x7fab96bccb8f ()\n#234 0x7fab96bccb8f ()\n#235 0x7fab96bccb8f ()\n#236 0x7fab96bccb8f ()\n#237 0x7fab96bccb8f ()\n#238 0x7fab96bccb8f ()\n#239 0x7fab96bccb8f ()\n#240 0x7fab96bccb8f ()\n#241 0x7fab96bccb8f ()\n#242 0x7fab96bccb8f ()\n#243 0x7fab96bccb8f ()\n#244 0x7fab96bccb8f ()\n#245 0x7fab96bccb8f ()\n#246 0x7fab96bccb8f ()\n#247 0x7fab96bccb8f ()\n#248 0x7fab96bccb8f ()\n#249 0x7fab96bccb8f ()\n#250 0x7fab96bccb8f ()\n#251 0x7fab96bccb8f ()\n#252 0x7fab96bccb8f ()\n#253 0x7fab96bccb8f ()\n#254 0x7fab96bccb8f ()\n #255 0x7fab96bccb8f ()\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: ILL (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-no-engine_jsc_b0799c36b671da909defc43d3a0fa14299c575c8/revisions/jsc+0x2ade51b)\n==22566==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/stacktrace-parser/Cargo.toml b/src/agent/stacktrace-parser/Cargo.toml index a5d1939479..2836afbced 100644 --- a/src/agent/stacktrace-parser/Cargo.toml +++ b/src/agent/stacktrace-parser/Cargo.toml @@ -16,4 +16,5 @@ serde_json = "1.0" libclusterfuzz = { path = "../libclusterfuzz" } [dev-dependencies] +insta = { version = "1.29.0", features = ["glob", "json"] } pretty_assertions = "1.3" diff --git a/src/agent/stacktrace-parser/data/parsed-traces/asan-check-failure-missing-symbolizer.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@asan-check-failure-missing-symbolizer.txt.snap similarity index 98% rename from src/agent/stacktrace-parser/data/parsed-traces/asan-check-failure-missing-symbolizer.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@asan-check-failure-missing-symbolizer.txt.snap index c7d472a1cd..a8589ee46c 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/asan-check-failure-missing-symbolizer.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@asan-check-failure-missing-symbolizer.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/asan-check-failure-missing-symbolizer.txt +--- { "text": "=================================================================\n==15479==AddressSanitizer CHECK failed: /build/llvm-toolchain-9-uSl4bC/llvm-toolchain-9-9/projects/compiler-rt/lib/asan/asan_descriptions.cc:80 \"((0 && \"Address is not in memory and not in shadow?\")) != (0)\" (0x0, 0x0)\n==15479==WARNING: invalid path to external symbolizer!\n==15479==WARNING: Failed to use and restart external symbolizer!\n #0 0x49a92e (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x49a92e)\n #1 0x4aef3f (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x4aef3f)\n #2 0x423516 (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x423516)\n #3 0x4245b6 (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x4245b6)\n #4 0x4261b2 (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x4261b2)\n #5 0x498180 (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x498180)\n #6 0x47ef01 (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x47ef01)\n #7 0x4c2223 (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x4c2223)\n #8 0x4c26b7 (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x4c26b7)\n #9 0x4c274d (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x4c274d)\n #10 0x7ffff6e22bf6 (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)\n #11 0x41ab39 (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x41ab39)\n\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/asan-check-failure.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@asan-check-failure.txt.snap similarity index 98% rename from src/agent/stacktrace-parser/data/parsed-traces/asan-check-failure.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@asan-check-failure.txt.snap index 813db8f50e..a524a1fed7 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/asan-check-failure.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@asan-check-failure.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/asan-check-failure.txt +--- { "text": "=================================================================\n==31189==AddressSanitizer CHECK failed: /build/llvm-toolchain-9-uSl4bC/llvm-toolchain-9-9/projects/compiler-rt/lib/asan/asan_descriptions.cc:80 \"((0 && \"Address is not in memory and not in shadow?\")) != (0)\" (0x0, 0x0)\n #0 0x49a92e in __asan::AsanCheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x49a92e)\n #1 0x4aef3f in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x4aef3f)\n #2 0x423516 in __asan::GetShadowAddressInformation(unsigned long, __asan::ShadowAddressDescription*) (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x423516)\n #3 0x4245b6 in __asan::AddressDescription::AddressDescription(unsigned long, unsigned long, bool) (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x4245b6)\n #4 0x4261b2 in __asan::ErrorGeneric::ErrorGeneric(unsigned int, unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long) (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x4261b2)\n #5 0x498180 in __asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x498180)\n #6 0x47ef01 in strncpy (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x47ef01)\n #7 0x4c2223 in check /home/runner/work/onefuzz/onefuzz/src/integration-tests/trivial-crash/fuzz.c:21:3\n #8 0x4c26b7 in from_file /home/runner/work/onefuzz/onefuzz/src/integration-tests/trivial-crash/fuzz.c:67:12\n #9 0x4c274d in main /home/runner/work/onefuzz/onefuzz/src/integration-tests/trivial-crash/fuzz.c:81:12\n #10 0x7ffff6e22bf6 in __libc_start_main /build/glibc-S7xCS9/glibc-2.27/csu/../csu/libc-start.c:310\n #11 0x41ab39 in _start (/onefuzz/blob-containers/oft-setup-7dd77f97cb7557789a822f10f227df19/fuzz.exe+0x41ab39)\n\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/asan-odr-violation.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@asan-odr-violation.txt.snap similarity index 94% rename from src/agent/stacktrace-parser/data/parsed-traces/asan-odr-violation.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@asan-odr-violation.txt.snap index 98f6aa8432..4a9e4ca50e 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/asan-odr-violation.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@asan-odr-violation.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/asan-odr-violation.txt +--- { "text": "=================================================================\n==10896==ERROR: AddressSanitizer: odr-violation (0x7fffc6d5bd60):\n [1] size=64 'vtable for a::b' ../../a/b.cc\n [2] size=64 'vtable for a::b' ../../a/b.cc\nThese globals were registered at these points:\n [1]:\n #0 0x555556716bcd in __asan_register_globals /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_globals.cpp:360:3\n #1 0x7fff9886d28b in asan.module_ctor (/onefuzz/blob-containers/oft-setup-b9607df0891452adabf9aab8954aa772/libviews.so+0xb0228b)\n\n [2]:\n #0 0x555556716bcd in __asan_register_globals /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_globals.cpp:360:3\n #1 0x7fffc6d58ccb in asan.module_ctor (/onefuzz/blob-containers/oft-setup-b9607df0891452adabf9aab8954aa772/libx11_window.so+0x46ccb)\n\n==10896==HINT: if you don't care about these errors you may set ASAN_OPTIONS=detect_odr_violation=0\nSUMMARY: AddressSanitizer: odr-violation: global 'vtable for a::b' at ../../a/b.cc\n==10896==ABORTING", "sanitizer": "AddressSanitizer", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/clang-10-asan-breakpoint.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@clang-10-asan-breakpoint.txt.snap similarity index 99% rename from src/agent/stacktrace-parser/data/parsed-traces/clang-10-asan-breakpoint.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@clang-10-asan-breakpoint.txt.snap index e53d69ee1e..9dca1fbd5f 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/clang-10-asan-breakpoint.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@clang-10-asan-breakpoint.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/clang-10-asan-breakpoint.txt +--- { "text": "=================================================================\n==24004==ERROR: AddressSanitizer: breakpoint on unknown address 0x000000000000 (pc 0x7ffd10f6e42d bp 0x009369dfde00 sp 0x009369dfdd30 T0)\n==24004==The signal is caused by a READ memory access.\n==24004==Hint: address points to the zero page.\n==24004==*** WARNING: Failed to initialize DbgHelp! ***\n==24004==*** Most likely this means that the app is already ***\n==24004==*** using DbgHelp, possibly with incompatible flags. ***\n==24004==*** Due to technical reasons, symbolization might crash ***\n==24004==*** or produce wrong results. ***\n #0 0x7ffd10f6e42c (C:\\test.dll+0x18a7fe42c)\n #1 0x7ffd10e13e1f (C:\\test.dll+0x18a6a3e1f)\n #2 0x7ffd10e15bdf (C:\\test.dll+0x18a6a5bdf)\n #3 0x7ffd0ab31ac0 (C:\\test.dll+0x1843c1ac0)\n #4 0x7ffd0ae49707 (C:\\test.dll+0x1846d9707)\n #5 0x7ffd0a54a128 (C:\\test.dll+0x183dda128)\n #6 0x7ffd0a549ed6 (C:\\test.dll+0x183dd9ed6)\n #7 0x7ffd0af6b003 (C:\\test.dll+0x1847fb003)\n #8 0x7ffd0af46cac (C:\\test.dll+0x1847d6cac)\n #9 0x7ffd0af4672a (C:\\test.dll+0x1847d672a)\n #10 0x7ffd0af46633 (C:\\test.dll+0x1847d6633)\n #11 0x7ffd0b7b79fe (C:\\test.dll+0x1850479fe)\n #12 0x7ffd0b892cc5 (C:\\test.dll+0x185122cc5)\n #13 0x7ffd0b886fe9 (C:\\test.dll+0x185116fe9)\n #14 0x7ffd0b8866c3 (C:\\test.dll+0x1851166c3)\n #15 0x7ffd0b7954ce (C:\\test.dll+0x1850254ce)\n #16 0x7ffd0b794ee9 (C:\\test.dll+0x185024ee9)\n #17 0x7ffd0b78a8b5 (C:\\test.dll+0x18501a8b5)\n #18 0x7ffd0b78b3f8 (C:\\test.dll+0x18501b3f8)\n #19 0x7ffd0b78b877 (C:\\test.dll+0x18501b877)\n #20 0x7ffd0bbdb28a (C:\\test.dll+0x18546b28a)\n #21 0x7ffd10edbc89 (C:\\test.dll+0x18a76bc89)\n #22 0x7ffd13a8f11e (C:\\test.dll+0x18d31f11e)\n #23 0x7ffd13a8e82a (C:\\test.dll+0x18d31e82a)\n #24 0x7ffd10f8f130 (C:\\test.dll+0x18a81f130)\n #25 0x7ffd10f8cc2f (C:\\test.dll+0x18a81cc2f)\n #26 0x7ffd13a90833 (C:\\test.dll+0x18d320833)\n #27 0x7ffd10e8ecf1 (C:\\test.dll+0x18a71ecf1)\n #28 0x7ffd13609469 (C:\\test.dll+0x18ce99469)\n #29 0x7ffd09fa4753 (C:\\test.dll+0x183834753)\n #30 0x7ffd09faa46b (C:\\test.dll+0x18383a46b)\n #31 0x7ffd09f9cbf0 (C:\\test.dll+0x18382cbf0)\n #32 0x7ffd10b2287d (C:\\test.dll+0x18a3b287d)\n #33 0x7ffd10b25220 (C:\\test.dll+0x18a3b5220)\n #34 0x7ffd10b243fc (C:\\test.dll+0x18a3b43fc)\n #35 0x7ffd10be2b6c (C:\\test.dll+0x18a472b6c)\n #36 0x7ffd10b22644 (C:\\test.dll+0x18a3b2644)\n #37 0x7ffd0677162b (C:\\test.dll+0x18000162b)\n #38 0x7ff69ea06fd6 (C:\\test.exe+0x140006fd6)\n #39 0x7ff69ea03d34 (C:\\test.exe+0x140003d34)\n #40 0x7ff69ef2432f (C:\\test.exe+0x14052432f)\n #41 0x7ffdbbfe6fd3 (C:\\WINDOWS\\System32\\KERNEL32.DLL+0x180016fd3)\n #42 0x7ffdbc51cec0 (C:\\WINDOWS\\SYSTEM32\\ntdll.dll+0x18004cec0)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: breakpoint (C:\\test.dll+0x18a7fe42c) \n==24004==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/dotnet-nested-exception-linenumbers.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@dotnet-nested-exception-linenumbers.txt.snap similarity index 97% rename from src/agent/stacktrace-parser/data/parsed-traces/dotnet-nested-exception-linenumbers.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@dotnet-nested-exception-linenumbers.txt.snap index d886e631fc..0a4a3b4813 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/dotnet-nested-exception-linenumbers.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@dotnet-nested-exception-linenumbers.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/dotnet-nested-exception-linenumbers.txt +--- { "text": "Unhandled exception. System.Exception: No fuzzing target specified\n ---> System.Exception: Missing `LIBFUZZER_DOTNET_TARGET` environment variables: LIBFUZZER_DOTNET_TARGET_ASSEMBLY, LIBFUZZER_DOTNET_TARGET_CLASS, LIBFUZZER_DOTNET_TARGET_METHOD\n at LibFuzzerDotnetLoader.LibFuzzerDotnetTarget.FromEnvironmentVars() in /workspaces/onefuzz/src/agent/LibFuzzerDotnetLoader/Program.cs:line 190\n at LibFuzzerDotnetLoader.LibFuzzerDotnetTarget.FromEnvironment() in /workspaces/onefuzz/src/agent/LibFuzzerDotnetLoader/Program.cs:line 166\n --- End of inner exception stack trace ---\n at LibFuzzerDotnetLoader.LibFuzzerDotnetTarget.FromEnvironment() in /workspaces/onefuzz/src/agent/LibFuzzerDotnetLoader/Program.cs:line 171\n at LibFuzzerDotnetLoader.Program.TryMain() in /workspaces/onefuzz/src/agent/LibFuzzerDotnetLoader/Program.cs:line 70\n at LibFuzzerDotnetLoader.Program.Main(String[] args) in /workspaces/onefuzz/src/agent/LibFuzzerDotnetLoader/Program.cs:line 57\n", "sanitizer": ".NET", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/dotnet-unhandled-exception.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@dotnet-unhandled-exception.txt.snap similarity index 98% rename from src/agent/stacktrace-parser/data/parsed-traces/dotnet-unhandled-exception.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@dotnet-unhandled-exception.txt.snap index d1b2e37cbd..605d56953c 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/dotnet-unhandled-exception.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@dotnet-unhandled-exception.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/dotnet-unhandled-exception.txt +--- { "text": "INFO: libFuzzer ignores flags that start with '--'\nINFO: Running with entropic power schedule (0xFF, 100).\nINFO: Seed: 2166901369\nINFO: Loaded 1 modules (62 inline 8-bit counters): 62 [0x5638c2758000, 0x5638c275803e), \nINFO: Loaded 1 PC tables (62 PCs): 62 [0x5638c2758040,0x5638c2758420), \nINFO: 65536 Extra Counters\n./libfuzzer-dotnet: Running 1 inputs 1 time(s) each.\nRunning: /workspaces/onefuzz/src/integration-tests/GoodBad/crash-64641bf3cd8aca3e3cc07ebe8a55436cf93e9ee3\nSystem.IndexOutOfRangeException: Index was outside the bounds of the array.\n at GoodBad.BinaryParser.ProcessInput(ReadOnlySpan`1 data)\n at GoodBad.Fuzzer.TestInput(ReadOnlySpan`1 data)\n at SharpFuzz.Fuzzer.LibFuzzer.Run(ReadOnlySpanAction action)\n==25524== ERROR: libFuzzer: deadly signal\n #0 0x5638c2723b94 in __sanitizer_print_stack_trace (/workspaces/onefuzz/src/integration-tests/GoodBad/libfuzzer-dotnet+0x68b94) (BuildId: d096e3fad0effc0b4b767afc99ef289ff780dc6e)\n #1 0x5638c26fa5a8 in fuzzer::PrintStackTrace() (/workspaces/onefuzz/src/integration-tests/GoodBad/libfuzzer-dotnet+0x3f5a8) (BuildId: d096e3fad0effc0b4b767afc99ef289ff780dc6e)\n #2 0x5638c26e0023 in fuzzer::Fuzzer::CrashCallback() (/workspaces/onefuzz/src/integration-tests/GoodBad/libfuzzer-dotnet+0x25023) (BuildId: d096e3fad0effc0b4b767afc99ef289ff780dc6e)\n #3 0x7f51e300251f (/lib/x86_64-linux-gnu/libc.so.6+0x4251f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)\n #4 0x5638c2724ae6 in LLVMFuzzerTestOneInput (/workspaces/onefuzz/src/integration-tests/GoodBad/libfuzzer-dotnet+0x69ae6) (BuildId: d096e3fad0effc0b4b767afc99ef289ff780dc6e)\n #5 0x5638c26e15b3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/workspaces/onefuzz/src/integration-tests/GoodBad/libfuzzer-dotnet+0x265b3) (BuildId: d096e3fad0effc0b4b767afc99ef289ff780dc6e)\n #6 0x5638c26cb32f in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/workspaces/onefuzz/src/integration-tests/GoodBad/libfuzzer-dotnet+0x1032f) (BuildId: d096e3fad0effc0b4b767afc99ef289ff780dc6e)\n #7 0x5638c26d1086 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/workspaces/onefuzz/src/integration-tests/GoodBad/libfuzzer-dotnet+0x16086) (BuildId: d096e3fad0effc0b4b767afc99ef289ff780dc6e)\n #8 0x5638c26faea2 in main (/workspaces/onefuzz/src/integration-tests/GoodBad/libfuzzer-dotnet+0x3fea2) (BuildId: d096e3fad0effc0b4b767afc99ef289ff780dc6e)\n #9 0x7f51e2fe9d8f (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)\n #10 0x7f51e2fe9e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)\n #11 0x5638c26c5bf4 in _start (/workspaces/onefuzz/src/integration-tests/GoodBad/libfuzzer-dotnet+0xabf4) (BuildId: d096e3fad0effc0b4b767afc99ef289ff780dc6e)\n\nNOTE: libFuzzer has rudimentary signal handlers.\n Combine libFuzzer with AddressSanitizer or similar for better crash reports.\nSUMMARY: libFuzzer: deadly signal\n", "sanitizer": ".NET", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/format-string.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@format-string.txt.snap similarity index 72% rename from src/agent/stacktrace-parser/data/parsed-traces/format-string.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@format-string.txt.snap index 5a24454532..3096f812eb 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/format-string.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@format-string.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/format-string.txt +--- { "text": "==16627==AddressSanitizer: WARNING: unexpected format specifier in printf interceptor: %r (reported once per process)\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-asan-log.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-asan-log.txt.snap similarity index 98% rename from src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-asan-log.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-asan-log.txt.snap index 9d8207f744..e626d594a6 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-asan-log.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-asan-log.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/libfuzzer-asan-log.txt +--- { "text": "INFO: Seed: 2746158486\nINFO: Loaded 1 modules (21 inline 8-bit counters): 21 [0x766ef0, 0x766f05), \nINFO: Loaded 1 PC tables (21 PCs): 21 [0x542fd0,0x543120), \n./fuzz.exe: Running 1 inputs 1 time(s) each.\nRunning: crash-cbe07cd3ebaba15610ecd968c4e4a04c6643e534\n=================================================================\n==17066==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000000050 at pc 0x000000527476 bp 0x7ffeb9b631d0 sp 0x7ffeb9b631c8\nWRITE of size 4 at 0x602000000050 thread T0\n #0 0x527475 in LLVMFuzzerTestOneInput /home/testuser/projects/onefuzz/samples/asan/fuzz.c:45:51\n #1 0x42fb3a in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x42fb3a)\n #2 0x41ef87 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x41ef87)\n #3 0x424ba1 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x424ba1)\n #4 0x44bd72 in main (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x44bd72)\n #5 0x7fbf0729bb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310\n #6 0x41d879 in _start (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x41d879)\n\n0x602000000050 is located 0 bytes inside of 4-byte region [0x602000000050,0x602000000054)\nfreed by thread T0 here:\n #0 0x4f72e2 in free (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x4f72e2)\n #1 0x52742f in LLVMFuzzerTestOneInput /home/testuser/projects/onefuzz/samples/asan/fuzz.c:45:39\n #2 0x42fb3a in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x42fb3a)\n #3 0x41ef87 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x41ef87)\n #4 0x424ba1 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x424ba1)\n #5 0x44bd72 in main (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x44bd72)\n #6 0x7fbf0729bb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310\n\npreviously allocated by thread T0 here:\n #0 0x4f7663 in __interceptor_malloc (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x4f7663)\n #1 0x527419 in LLVMFuzzerTestOneInput /home/testuser/projects/onefuzz/samples/asan/fuzz.c:45:18\n #2 0x42fb3a in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x42fb3a)\n #3 0x41ef87 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x41ef87)\n #4 0x424ba1 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x424ba1)\n #5 0x44bd72 in main (/home/testuser/projects/onefuzz/samples/asan/fuzz.exe+0x44bd72)\n #6 0x7fbf0729bb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/testuser/projects/onefuzz/samples/asan/fuzz.c:45:51 in LLVMFuzzerTestOneInput\nShadow bytes around the buggy address:\n 0x0c047fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x0c047fff8000: fa fa 04 fa fa fa 04 fa fa fa[fd]fa fa fa fa fa\n 0x0c047fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n 0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==17066==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-deadly-signal.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-deadly-signal.txt.snap similarity index 98% rename from src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-deadly-signal.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-deadly-signal.txt.snap index 96d1f0cc59..833750e176 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-deadly-signal.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-deadly-signal.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/libfuzzer-deadly-signal.txt +--- { "text": "INFO: Seed: 1417742161\nINFO: Loaded 2 modules (16763 inline 8-bit counters): 14323 [0x7f1ee459ce50, 0x7f1ee45a0643), 2440 [0x56512aac5ae0, 0x56512aac6468), \nINFO: Loaded 2 PC tables (16763 PCs): 14323 [0x7f1ee45a0648,0x7f1ee45d8578), 2440 [0x56512aac6468,0x56512aacfce8), \n../linux_x64_asan_libfuzz_release/jsoncpp_fuzzer: Running 1 inputs 1 time(s) each.\nRunning: ./crash-975f93376ba7c1af9f1f2fd891f9e5714f06e69c\n==23788== ERROR: libFuzzer: deadly signal\n #0 0x56512a9c1418 in __sanitizer_print_stack_trace /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_stack.cpp:86:3\n #1 0x56512aaaa42d in fuzzer::PrintStackTrace() third_party/libFuzzer/src/FuzzerUtil.cpp:205:5\n #2 0x56512aa6a85e in fuzzer::Fuzzer::CrashCallback() third_party/libFuzzer/src/FuzzerLoop.cpp:232:3\n #3 0x56512aa6a7df in fuzzer::Fuzzer::StaticCrashSignalCallback() third_party/libFuzzer/src/FuzzerLoop.cpp:203:6\n #4 0x56512aaab948 in fuzzer::CrashHandler(int, siginfo_t*, void*) third_party/libFuzzer/src/FuzzerUtilPosix.cpp:46:3\n #5 0x7f1ee3f0188f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1288f)\n #6 0x56512a9e5aa1 in Json::OurReader::parse(char const*, char const*, Json::Value&, bool) third_party/jsoncpp/source/src/lib_json/json_reader.cpp:1062:10\n #7 0x56512a9eedb4 in Json::OurCharReader::parse(char const*, char const*, Json::Value*, std::__Cr::basic_string, std::__Cr::allocator >*) third_party/jsoncpp/source/src/lib_json/json_reader.cpp:1899:23\n #8 0x56512a9e03a3 in LLVMFuzzerTestOneInput third_party/jsoncpp/fuzzers/json_fuzzer.cc:39:24\n #9 0x56512aa6d0cf in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:556:15\n #10 0x56512aa3b7da in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:292:6\n #11 0x56512aa4108a in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:774:9\n #12 0x56512aa821ac in main third_party/libFuzzer/src/FuzzerMain.cpp:19:10\n #13 0x7f1ee3361b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310\n\nNOTE: libFuzzer has rudimentary signal handlers.\n Combine libFuzzer with AddressSanitizer or similar for better crash reports.\nSUMMARY: libFuzzer: deadly signal\n", "sanitizer": "libFuzzer", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-linux-llvm10-out-of-memory-malloc.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-linux-llvm10-out-of-memory-malloc.txt.snap similarity index 98% rename from src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-linux-llvm10-out-of-memory-malloc.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-linux-llvm10-out-of-memory-malloc.txt.snap index cb5b2698f3..f0ce9a38c5 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-linux-llvm10-out-of-memory-malloc.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-linux-llvm10-out-of-memory-malloc.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/libfuzzer-linux-llvm10-out-of-memory-malloc.txt +--- { "text": "INFO: Seed: 3452367435\nINFO: Loaded 1 modules (12 inline 8-bit counters): 12 [0x7a1eb0, 0x7a1ebc),\nINFO: Loaded 1 PC tables (12 PCs): 12 [0x566fd8,0x567098),\n./fuzz.exe: Running 1 inputs 1 time(s) each.\nRunning: good.txt\n==25300== ERROR: libFuzzer: out-of-memory (malloc(100000000))\n To change the out-of-memory limit use -rss_limit_mb=\n\n #0 0x526011 in __sanitizer_print_stack_trace (/home/user/src/onefuzz/src/agent/fuzz.exe+0x526011)\n #1 0x471168 in fuzzer::PrintStackTrace() (/home/user/src/onefuzz/src/agent/fuzz.exe+0x471168)\n #2 0x455495 in fuzzer::Fuzzer::HandleMalloc(unsigned long) (/home/user/src/onefuzz/src/agent/fuzz.exe+0x455495)\n #3 0x4553aa in fuzzer::MallocHook(void const volatile*, unsigned long) (/home/user/src/onefuzz/src/agent/fuzz.exe+0x4553aa)\n #4 0x52c337 in __sanitizer::RunMallocHooks(void const*, unsigned long) (/home/user/src/onefuzz/src/agent/fuzz.exe+0x52c337)\n #5 0x4a69f1 in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) (/home/user/src/onefuzz/src/agent/fuzz.exe+0x4a69f1)\n #6 0x4a61c3 in __asan::asan_malloc(unsigned long, __sanitizer::BufferedStackTrace*) (/home/user/src/onefuzz/src/agent/fuzz.exe+0x4a61c3)\n #7 0x51d53b in malloc (/home/user/src/onefuzz/src/agent/fuzz.exe+0x51d53b)\n #8 0x54cc24 in LLVMFuzzerTestOneInput /home/user/src/onefuzz/src/agent/fuzz.c:9:18\n #9 0x457971 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/user/src/onefuzz/src/agent/fuzz.exe+0x457971)\n #10 0x4430e2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/user/src/onefuzz/src/agent/fuzz.exe+0x4430e2)\n #11 0x448b96 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/user/src/onefuzz/src/agent/fuzz.exe+0x448b96)\n #12 0x471852 in main (/home/user/src/onefuzz/src/agent/fuzz.exe+0x471852)\n #13 0x7f6b3d630b96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310\n #14 0x41d7a9 in _start (/home/user/src/onefuzz/src/agent/fuzz.exe+0x41d7a9)\n\nSUMMARY: libFuzzer: out-of-memory", "sanitizer": "libFuzzer", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-linux-llvm10-out-of-memory-rss.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-linux-llvm10-out-of-memory-rss.txt.snap similarity index 95% rename from src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-linux-llvm10-out-of-memory-rss.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-linux-llvm10-out-of-memory-rss.txt.snap index 8f98515f52..d3e2c26694 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-linux-llvm10-out-of-memory-rss.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-linux-llvm10-out-of-memory-rss.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/libfuzzer-linux-llvm10-out-of-memory-rss.txt +--- { "text": "INFO: Seed: 3192757444\nINFO: Loaded 1 modules (12 inline 8-bit counters): 12 [0x7a1eb0, 0x7a1ebc),\nINFO: Loaded 1 PC tables (12 PCs): 12 [0x566fd8,0x567098),\n./fuzz.exe: Running 1 inputs 1 time(s) each.\nRunning: good.txt\n==25201== ERROR: libFuzzer: out-of-memory (used: 134Mb; limit: 1Mb)\n To change the out-of-memory limit use -rss_limit_mb=\n\nLive Heap Allocations: 21573335 bytes in 22 chunks; quarantined: 100009208 bytes in 8 chunks; 5943 other chunks; total chunks: 5973; showing top 95% (at most 8 unique contexts)\n21499304 byte(s) (99%) in 10 allocation(s)\n #0 0x51d4dd in malloc (/home/user/src/onefuzz/src/agent/fuzz.exe+0x51d4dd)\n #1 0x431b97 in operator new(unsigned long) (/home/user/src/onefuzz/src/agent/fuzz.exe+0x431b97)\n #2 0x471852 in main (/home/user/src/onefuzz/src/agent/fuzz.exe+0x471852)\n #3 0x7f2e2eb89b96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310\n\nSUMMARY: libFuzzer: out-of-memory", "sanitizer": "libFuzzer", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-scariness-underflow.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-scariness-underflow.txt.snap similarity index 98% rename from src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-scariness-underflow.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-scariness-underflow.txt.snap index 3e3e5eaf90..720be665d9 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-scariness-underflow.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-scariness-underflow.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/libfuzzer-scariness-underflow.txt +--- { "text": "=================================================================\n==32266==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7ffd2173f200 at pc 0x0000004fd403 bp 0x7ffd2173f1f0 sp 0x7ffd2173f1e8\nWRITE of size 4 at 0x7ffd2173f200 thread T0\nSCARINESS: 51 (4-byte-write-stack-buffer-underflow)\n #0 0x4fd402 in LLVMFuzzerTestOneInput /home/runner/work/onefuzz/onefuzz/src/integration-tests/libfuzzer/simple.c:28:69\n #1 0x43b271 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/tmp/xx/linux-libfuzzer/fuzz.exe+0x43b271)\n #2 0x43a9a5 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) (/tmp/xx/linux-libfuzzer/fuzz.exe+0x43a9a5)\n #3 0x43cf9b in fuzzer::Fuzzer::MutateAndTestOne() (/tmp/xx/linux-libfuzzer/fuzz.exe+0x43cf9b)\n #4 0x43dd15 in fuzzer::Fuzzer::Loop(std::vector >&) (/tmp/xx/linux-libfuzzer/fuzz.exe+0x43dd15)\n #5 0x42999b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/tmp/xx/linux-libfuzzer/fuzz.exe+0x42999b)\n #6 0x4557a2 in main (/tmp/xx/linux-libfuzzer/fuzz.exe+0x4557a2)\n #7 0x7f878654d0b2 in __libc_start_main /build/glibc-YYA7BZ/glibc-2.31/csu/../csu/libc-start.c:308:16\n #8 0x41db59 in _start (/tmp/xx/linux-libfuzzer/fuzz.exe+0x41db59)\n\nAddress 0x7ffd2173f200 is located in stack of thread T0 at offset 0 in frame\n #0 0x4fcccf in LLVMFuzzerTestOneInput /home/runner/work/onefuzz/onefuzz/src/integration-tests/libfuzzer/simple.c:8\n\n This frame has 1 object(s):\n [32, 36) 'cnt' (line 9)\nHINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork\n (longjmp and C++ exceptions *are* supported)\nSUMMARY: AddressSanitizer: stack-buffer-underflow /home/runner/work/onefuzz/onefuzz/src/integration-tests/libfuzzer/simple.c:28:69 in LLVMFuzzerTestOneInput\nShadow bytes around the buggy address:\n 0x1000242dfdf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x1000242dfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x1000242dfe10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x1000242dfe20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x1000242dfe30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x1000242dfe40:[f1]f1 f1 f1 04 f3 f3 f3 00 00 00 00 00 00 00 00\n 0x1000242dfe50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x1000242dfe60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x1000242dfe70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x1000242dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n 0x1000242dfe90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07 \n Heap left redzone: fa\n Freed heap region: fd\n Stack left redzone: f1\n Stack mid redzone: f2\n Stack right redzone: f3\n Stack after return: f5\n Stack use after scope: f8\n Global redzone: f9\n Global init order: f6\n Poisoned by user: f7\n Container overflow: fc\n Array cookie: ac\n Intra object redzone: bb\n ASan internal: fe\n Left alloca redzone: ca\n Right alloca redzone: cb\n Shadow gap: cc\n==32266==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-scariness.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-scariness.txt.snap similarity index 98% rename from src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-scariness.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-scariness.txt.snap index 76b9fec708..e88b9aa8bf 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-scariness.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-scariness.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/libfuzzer-scariness.txt +--- { "text": "=================================================================\n==28073==ERROR: AddressSanitizer: FPE on unknown address 0x0000004fd774 (pc 0x0000004fd774 bp 0x7ffd45d2c110 sp 0x7ffd45d2bf00 T0)\nSCARINESS: 10 (signal)\n #0 0x4fd773 in LLVMFuzzerTestOneInput /home/runner/work/onefuzz/onefuzz/src/integration-tests/libfuzzer/simple.c:58:32\n #1 0x43b271 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/tmp/xx/linux-libfuzzer/fuzz.exe+0x43b271)\n #2 0x43a9a5 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) (/tmp/xx/linux-libfuzzer/fuzz.exe+0x43a9a5)\n #3 0x43cf9b in fuzzer::Fuzzer::MutateAndTestOne() (/tmp/xx/linux-libfuzzer/fuzz.exe+0x43cf9b)\n #4 0x43dd15 in fuzzer::Fuzzer::Loop(std::vector >&) (/tmp/xx/linux-libfuzzer/fuzz.exe+0x43dd15)\n #5 0x42999b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/tmp/xx/linux-libfuzzer/fuzz.exe+0x42999b)\n #6 0x4557a2 in main (/tmp/xx/linux-libfuzzer/fuzz.exe+0x4557a2)\n #7 0x7fc6b74190b2 in __libc_start_main /build/glibc-YYA7BZ/glibc-2.31/csu/../csu/libc-start.c:308:16\n #8 0x41db59 in _start (/tmp/xx/linux-libfuzzer/fuzz.exe+0x41db59)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: FPE /home/runner/work/onefuzz/onefuzz/src/integration-tests/libfuzzer/simple.c:58:32 in LLVMFuzzerTestOneInput\n==28073==ABORTING\n", "sanitizer": "AddressSanitizer", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-windows-llvm10-out-of-memory-malloc.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-windows-llvm10-out-of-memory-malloc.txt.snap similarity index 98% rename from src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-windows-llvm10-out-of-memory-malloc.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-windows-llvm10-out-of-memory-malloc.txt.snap index b62c0ef1d5..295fe5c95e 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-windows-llvm10-out-of-memory-malloc.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-windows-llvm10-out-of-memory-malloc.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/libfuzzer-windows-llvm10-out-of-memory-malloc.txt +--- { "text": "INFO: Seed: 695951618\nINFO: Loaded 1 modules (12 inline 8-bit counters): 12 [00007FF739F96088, 00007FF739F96094),\nINFO: Loaded 1 PC tables (12 PCs): 12 [00007FF739F48720,00007FF739F487E0),\nX:\\fuzz\\fuzz.exe: Running 1 inputs 1 time(s) each.\nRunning: .\\good.txt\n==1060== ERROR: libFuzzer: out-of-memory (malloc(2000000))\n To change the out-of-memory limit use -rss_limit_mb=\n\n #0 0x7ff739e118a8 in __sanitizer_print_stack_trace C:\\src\\llvm_package_1000-final\\llvm-project\\compiler-rt\\lib\\asan\\asan_stack.cpp:86\n #1 0x7ff739e38a84 in fuzzer::PrintStackTrace(void) C:\\src\\llvm_package_1000-final\\llvm-project\\compiler-rt\\lib\\fuzzer\\FuzzerUtil.cpp:205\n #2 0x7ff739e570d1 in fuzzer::Fuzzer::HandleMalloc(unsigned __int64) C:\\src\\llvm_package_1000-final\\llvm-project\\compiler-rt\\lib\\fuzzer\\FuzzerLoop.cpp:130\n #3 0x7ff739e56ff7 in fuzzer::MallocHook(void const volatile *, unsigned __int64) C:\\src\\llvm_package_1000-final\\llvm-project\\compiler-rt\\lib\\fuzzer\\FuzzerLoop.cpp:99\n #4 0x7ff739e0a739 in __sanitizer::RunMallocHooks(void const *, unsigned __int64) C:\\src\\llvm_package_1000-final\\llvm-project\\compiler-rt\\lib\\sanitizer_common\\sanitizer_common.cpp:299\n #5 0x7ff739e2c862 in __asan::Allocator::Allocate(unsigned __int64, unsigned __int64, struct __sanitizer::BufferedStackTrace *, enum __asan::AllocType, bool) C:\\src\\llvm_package_1000-final\\llvm-project\\compiler-rt\\lib\\asan\\asan_allocator.cpp:560\n #6 0x7ff739e2c169 in __asan::asan_malloc(unsigned __int64, struct __sanitizer::BufferedStackTrace *) C:\\src\\llvm_package_1000-final\\llvm-project\\compiler-rt\\lib\\asan\\asan_allocator.cpp:892\n #7 0x7ff739e19730 in malloc C:\\src\\llvm_package_1000-final\\llvm-project\\compiler-rt\\lib\\asan\\asan_malloc_win.cpp:99\n #8 0x7ff739df1061 in LLVMFuzzerTestOneInput (X:\\fuzz\\fuzz.exe+0x140001061)\n #9 0x7ff739e5a0ea in fuzzer::Fuzzer::ExecuteCallback(unsigned char const *, unsigned __int64) C:\\src\\llvm_package_1000-final\\llvm-project\\compiler-rt\\lib\\fuzzer\\FuzzerLoop.cpp:556\n #10 0x7ff739e6d025 in fuzzer::RunOneTest(class fuzzer::Fuzzer *, char const *, unsigned __int64) C:\\src\\llvm_package_1000-final\\llvm-project\\compiler-rt\\lib\\fuzzer\\FuzzerDriver.cpp:293\n #11 0x7ff739e72076 in fuzzer::FuzzerDriver(int *, char ***, int (__cdecl *)(unsigned char const *, unsigned __int64)) C:\\src\\llvm_package_1000-final\\llvm-project\\compiler-rt\\lib\\fuzzer\\FuzzerDriver.cpp:779\n #12 0x7ff739e33ec2 in main C:\\src\\llvm_package_1000-final\\llvm-project\\compiler-rt\\lib\\fuzzer\\FuzzerMain.cpp:19\n #13 0x7ff739e79b5f in __scrt_common_main_seh d:\\A01\\_work\\6\\s\\src\\vctools\\crt\\vcstartup\\src\\startup\\exe_common.inl:288\n #14 0x7ffa95e46fd3 in BaseThreadInitThunk (C:\\WINDOWS\\System32\\KERNEL32.DLL+0x180016fd3)\n #15 0x7ffa975bcec0 in RtlUserThreadStart (C:\\WINDOWS\\SYSTEM32\\ntdll.dll+0x18004cec0)\n\nSUMMARY: libFuzzer: out-of-memory", "sanitizer": "libFuzzer", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-windows-llvm10-out-of-memory-rss.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-windows-llvm10-out-of-memory-rss.txt.snap similarity index 77% rename from src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-windows-llvm10-out-of-memory-rss.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-windows-llvm10-out-of-memory-rss.txt.snap index 633ae9d737..97fc99d670 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/libfuzzer-windows-llvm10-out-of-memory-rss.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@libfuzzer-windows-llvm10-out-of-memory-rss.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/libfuzzer-windows-llvm10-out-of-memory-rss.txt +--- { "text": "INFO: Seed: 3655625785\nINFO: Loaded 1 modules (12 inline 8-bit counters): 12 [00007FF7C1F46088, 00007FF7C1F46094),\nINFO: Loaded 1 PC tables (12 PCs): 12 [00007FF7C1EF8720,00007FF7C1EF87E0),\nX:\\fuzz\\fuzz.exe: Running 1 inputs 1 time(s) each.\nRunning: .\\good.txt\n==12788== ERROR: libFuzzer: out-of-memory (used: 178Mb; limit: 1Mb)\n To change the out-of-memory limit use -rss_limit_mb=\n\nSUMMARY: libFuzzer: out-of-memory", "sanitizer": "libFuzzer", diff --git a/src/agent/stacktrace-parser/data/parsed-traces/tsan-linux-llvm10-data-race.json b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@tsan-linux-llvm10-data-race.txt.snap similarity index 86% rename from src/agent/stacktrace-parser/data/parsed-traces/tsan-linux-llvm10-data-race.json rename to src/agent/stacktrace-parser/data/parsed-traces/check_dir@tsan-linux-llvm10-data-race.txt.snap index 336e563eda..fc3bd69548 100644 --- a/src/agent/stacktrace-parser/data/parsed-traces/tsan-linux-llvm10-data-race.json +++ b/src/agent/stacktrace-parser/data/parsed-traces/check_dir@tsan-linux-llvm10-data-race.txt.snap @@ -1,3 +1,8 @@ +--- +source: stacktrace-parser/src/lib.rs +expression: parsed +input_file: stacktrace-parser/data/stack-traces/tsan-linux-llvm10-data-race.txt +--- { "text": "==================\nWARNING: ThreadSanitizer: data race (pid=4659)\n Write of size 4 at 0x000001109278 by thread T1:\n #0 Thread1 /home/user/fuzz-targets/tiny_race.c:4:10 (tiny_race.exe+0x4ac607)\n\n Previous write of size 4 at 0x000001109278 by main thread:\n #0 main /home/user/fuzz-targets/tiny_race.c:10:10 (tiny_race.exe+0x4ac64e)\n\n Location is global 'Global' of size 4 at 0x000001109278 (tiny_race.exe+0x000001109278)\n\n Thread T1 (tid=4661, running) created by main thread at:\n #0 pthread_create (tiny_race.exe+0x422fe5)\n #1 main /home/user/fuzz-targets/tiny_race.c:9:3 (tiny_race.exe+0x4ac644)\n\nSUMMARY: ThreadSanitizer: data race /home/user/fuzz-targets/tiny_race.c:4:10 in Thread1\n==================\nThreadSanitizer: reported 1 warnings", "sanitizer": "ThreadSanitizer", diff --git a/src/agent/stacktrace-parser/src/lib.rs b/src/agent/stacktrace-parser/src/lib.rs index 00e0a815de..298713b5a7 100644 --- a/src/agent/stacktrace-parser/src/lib.rs +++ b/src/agent/stacktrace-parser/src/lib.rs @@ -329,44 +329,38 @@ pub fn digest_iter( #[cfg(test)] mod tests { use super::CrashLog; - use anyhow::{Context, Result}; - use pretty_assertions::assert_eq; + use anyhow::Context; + use std::ffi::OsStr; use std::fs; - use std::path::Path; fn check_dir( - src_dir: &Path, - expected_dir: &Path, - skip_files: Vec<&str>, - skip_minimized_check: Vec<&str>, - ) -> Result<()> { - for entry in fs::read_dir(src_dir)? { - let path = entry?.path(); - if !path.is_file() { - eprintln!("only checking files: {}", path.display()); - continue; - } - - let file_name = path.file_name().unwrap().to_str().unwrap(); + src_dir: &str, + expected_dir: &str, + skip_files: &[&OsStr], + skip_minimized_check: &[&OsStr], + ) { + insta::glob!(src_dir, "*.txt", |path| { + let file_name = path.file_name().unwrap(); if skip_files.contains(&file_name) { - eprintln!("skipping file: {file_name}"); - continue; - } else { - eprintln!("parsing file: {file_name}"); + eprintln!("skipping file: {path:?}"); + return; } - let data_raw = - fs::read_to_string(&path).with_context(|| format!("reading {}", path.display()))?; - let data = data_raw.replace("\r\n", "\n"); + let data_raw = fs::read_to_string(path) + .with_context(|| format!("reading {}", path.display())) + .unwrap(); - let parsed = CrashLog::parse(data.clone()).with_context(|| { - format!( - "parsing\n{}\n{}\n\n{}", - path.display(), - data, - path.display() - ) - })?; + let data = data_raw.replace("\r\n", "\n"); + let parsed = CrashLog::parse(data.clone()) + .with_context(|| { + format!( + "parsing\n{}\n{}\n\n{}", + path.display(), + data, + path.display() + ) + }) + .unwrap(); if !skip_minimized_check.contains(&file_name) && !parsed.call_stack.is_empty() @@ -379,44 +373,28 @@ mod tests { ); } - let mut expected_path = expected_dir.join(file_name); - expected_path.set_extension("json"); - if !expected_path.is_file() { - eprintln!( - "missing expected result: {} - {}", - path.display(), - expected_path.display() - ); - continue; - } - - let expected_data = fs::read_to_string(&expected_path)?; - let expected: CrashLog = serde_json::from_str(&expected_data)?; - assert_eq!(expected, parsed, "{}", path.display()); - } - Ok(()) + insta::with_settings!({ prepend_module_to_snapshot => false, snapshot_path => expected_dir }, { + insta::assert_json_snapshot!(parsed); + }); + }); } #[test] - fn test_asan_log_parse() -> Result<()> { - let src_dir = Path::new("data/stack-traces/"); - let expected_dir = Path::new("data/parsed-traces/"); - let skip_files = vec![]; - - let skip_minimized_check = vec!["asan-odr-violation.txt"]; - check_dir(src_dir, expected_dir, skip_files, skip_minimized_check)?; + fn test_asan_log_parse() { + let src_dir = "../data/stack-traces"; + let expected_dir = "../data/parsed-traces"; + let skip_files = []; + let skip_minimized_check = ["asan-odr-violation.txt"].map(OsStr::new); - Ok(()) + check_dir(src_dir, expected_dir, &skip_files, &skip_minimized_check); } #[test] - fn test_clusterfuzz_traces() -> Result<()> { - let src_dir = Path::new("../libclusterfuzz/data/stack-traces/"); - let expected_dir = Path::new("../libclusterfuzz/data/parsed-traces/"); - let skip_files = vec![ - // fuchsia libfuzzer - "fuchsia_ignore.txt", - "fuchsia_reproducible_crash.txt", + fn test_clusterfuzz_traces() { + let src_dir = "../../libclusterfuzz/data/stack-traces"; + let expected_dir = "../../libclusterfuzz/data/parsed-traces"; + + let skip_files = [ // other (non-libfuzzer) "android_null_stack.txt", "android_security_dcheck_failure.txt", @@ -458,7 +436,6 @@ mod tests { "security_dcheck_failure.txt", "v8_check.txt", "v8_check_eq.txt", - "v8_check_symbolized.txt", "v8_check_windows.txt", "v8_correctness_failure.txt", "v8_fatal_error_no_check.txt", @@ -470,22 +447,14 @@ mod tests { "v8_unimplemented_code.txt", "v8_unknown_fatal_error.txt", "v8_unreachable_code.txt", - "v8_dcheck_symbolized.txt", // golang - "golang_fatal_error_stack_overflow.txt", "golang_panic_custom_short_message.txt", - "golang_panic_runtime_error_slice_bounds_out_of_range.txt", - "golang_new_crash_type_and_asan_abrt.txt", - "golang_panic_runtime_error_index_out_of_range_with_msan.txt", "golang_panic_runtime_error_index_out_of_range.txt", "golang_panic_runtime_error_integer_divide_by_zero.txt", "golang_panic_runtime_error_invalid_memory_address.txt", "golang_panic_runtime_error_makeslice_len_out_of_range.txt", "golang_panic_with_type_assertions_in_frames.txt", "golang_sigsegv_panic.txt", - "golang_generic_fatal_error_and_asan_abrt.txt", - "golang_asan_panic.txt", - "golang_generic_panic_and_asan_abrt.txt", // linux kernel "android_kernel.txt", "android_kernel_no_parens.txt", @@ -514,22 +483,36 @@ mod tests { "hwasan_tag_mismatch.txt", // TODO - needs fixed "android_asan_uaf.txt", - // TODO - needs fixed, multi-line ASAN entry - "sanitizer_signal_abrt_unknown.txt", // java (from jazzer) "java_severity_medium_exception.txt", - ]; + ] + .map(OsStr::new); - let skip_minimized_check = vec![ + let skip_minimized_check = [ "clang-10-asan-breakpoint.txt", "asan-check-failure-missing-symbolizer.txt", // TODO: handle seeing LLVMFuzzerTestOneInput but not seeing the // source file name "libfuzzer_deadly_signal.txt", "lsan_direct_leak.txt", - ]; - check_dir(src_dir, expected_dir, skip_files, skip_minimized_check)?; + // TODO: address these: + "fuchsia_ignore.txt", + "fuchsia_reproducible_crash.txt", + // TODO: add parsing for golang traces + "golang_fatal_error_stack_overflow.txt", + "golang_generic_fatal_error_and_asan_abrt.txt", + "golang_generic_panic_and_asan_abrt.txt", + "golang_new_crash_type_and_asan_abrt.txt", + "golang_panic_runtime_error_index_out_of_range_with_msan.txt", + "golang_asan_panic.txt", + "golang_panic_runtime_error_slice_bounds_out_of_range.txt", + "v8_check_symbolized.txt", + "v8_dcheck_symbolized.txt", + // TODO - needs fixed, multi-line ASAN entry + //"sanitizer_signal_abrt_unknown.txt", + ] + .map(OsStr::new); - Ok(()) + check_dir(src_dir, expected_dir, &skip_files, &skip_minimized_check); } } From b1c72e0b7ff82159fc536440c65f2e97f911cef7 Mon Sep 17 00:00:00 2001 From: George Pollard Date: Mon, 17 Apr 2023 22:33:45 +0000 Subject: [PATCH 2/2] Update pre-reqs to also install cargo-insta --- src/ci/rust-prereqs.sh | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/src/ci/rust-prereqs.sh b/src/ci/rust-prereqs.sh index 22cf4be839..e6824347f6 100755 --- a/src/ci/rust-prereqs.sh +++ b/src/ci/rust-prereqs.sh @@ -5,14 +5,7 @@ set -ex -if ! sccache --help; then - cargo install sccache -fi +cargo install sccache cargo-license@0.4.2 cargo-llvm-cov cargo-deny cargo-insta + # sccache --start-server # export RUSTC_WRAPPER=$(which sccache) - -cargo install cargo-llvm-cov cargo-deny - -if ! cargo license --help; then - cargo install cargo-license@0.4.2 -fi