New issue
Advanced search Search tips

Issue 608247 link

Starred by 0 users

Issue metadata

Status: Duplicate
Owner:
Closed: May 2016
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in content::PPB_Graphics3D_Impl::ReturnFrontBuffer

Project Member Reported by ClusterFuzz, May 2 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4972585418227712

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x0000000000b0
Crash State:
  content::PPB_Graphics3D_Impl::ReturnFrontBuffer
  base::internal::Invoker<base::IndexSequence<0ul, 1ul>, base::internal::BindState
  cc::SingleReleaseCallback::Run
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=390527:390589

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95x5mMr2961JVhRCcGqFvUXDTObhlDh28xokdz1yPoc6I203GPw7SSAACfUvOaEm6OB4Oxik0oxAXYC8EYYSW4IgtNRtOMP5cQ4Ro4EBo6Tsyme3xeTQXZ8oZAz05DqnpiTxpwTzZiLmVPFsKLrcdF0-YX9-8v4cue9hj5hoydD8ucYI-A


Filer: brajkumar

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Labels: findit-for-crash Te-Logged
Owner: erikc...@chromium.org
Status: Assigned (was: Available)
The result is a list of CLs that change the crashed files.

Author: erikchen
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/ed5a6bb9f4321670482acc32a7cb4246a1e22f25
Time: Fri Apr 29 01:54:39 2016
Lines 131 of file ppb_graphics_3d_impl.cc which potentially caused crash are changed in this cl (frame #2, "content::PPB_Graphics3D_Impl::ReturnFrontBuffer").
Minimum distance from crash line to modified line: 0. (file: ppb_graphics_3d_impl.cc, crashed on: 128, modified: 128).

Suspected Project: chromium
Suspected Component: Internals>Core
=========================================
Above mentioned is the only CL list from findit, so suspecting the same.

erikchen@: Could you please look into this issue if it is related to your change,else please help us in assigning it to the right owner.

Thanks.

Project Member

Comment 2 by ClusterFuzz, May 2 2016

ClusterFuzz has detected this issue as fixed in range 390891:390895.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4972585418227712

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x0000000000b0
Crash State:
  content::PPB_Graphics3D_Impl::ReturnFrontBuffer
  base::internal::Invoker<base::IndexSequence<0ul, 1ul>, base::internal::BindState
  cc::SingleReleaseCallback::Run
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=390527:390589
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=390891:390895

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95x5mMr2961JVhRCcGqFvUXDTObhlDh28xokdz1yPoc6I203GPw7SSAACfUvOaEm6OB4Oxik0oxAXYC8EYYSW4IgtNRtOMP5cQ4Ro4EBo6Tsyme3xeTQXZ8oZAz05DqnpiTxpwTzZiLmVPFsKLrcdF0-YX9-8v4cue9hj5hoydD8ucYI-A


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Mergedinto: 608163
Status: Duplicate (was: Assigned)
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment