New issue
Advanced search Search tips

Issue 608250 link

Starred by 0 users

Issue metadata

Status: Duplicate
Owner:
Closed: May 2016
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in content::PPB_Graphics3D_Impl::ReturnFrontBuffer

Project Member Reported by ClusterFuzz, May 2 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5762312731885568

Fuzzer: attekett_dom_fuzzer
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000080
Crash State:
  content::PPB_Graphics3D_Impl::ReturnFrontBuffer
  content::PepperPluginInstanceImpl::FinishedConsumingCommittedTexture
  base::internal::Invoker<base::IndexSequence<0u, 1u>, base::internal::BindState<b
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=390527:390610

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96gZc0bKS3DUagpepIj_wtECJOqos8UbCxIL9-hX0L_3nApX2dj7elHSr-QEotL-KUSY7cKXwK_O7vLspxVqvYyh7a8pgFhvTsM384iVI49GgbKOwX-n81QKnKkimBNqP9zkvnsZnMSl17e_4Z4RBPcwZ__tYamoQqE1rSBtLZYJ_OniK4


Filer: brajkumar

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Labels: findit-for-crash
Owner: erikc...@chromium.org
Status: Assigned (was: Available)
	The result is a list of CLs that change the crashed files.

Author: erikchen
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/ed5a6bb9f4321670482acc32a7cb4246a1e22f25
Time: Fri Apr 29 01:54:39 2016
Lines 826-830 of file pepper_plugin_instance_impl.cc which potentially caused crash are changed in this cl (frame #2, "content::PepperPluginInstanceImpl::FinishedConsumingCommittedTexture").

Lines 131 of file ppb_graphics_3d_impl.cc which potentially caused crash are changed in this cl (frame #1, "content::PPB_Graphics3D_Impl::ReturnFrontBuffer").
Minimum distance from crash line to modified line: 0. (file: pepper_plugin_instance_impl.cc, crashed on: 826, modified: 826).

Suspected Project: chromium
Suspected Component: Internals>Core
=======================================
Above mentioned is the only CL list from findit, so suspecting the same.

erikchen@: Could you please look into this issue if it is related to your change,else please help us in assigning it to the right owner.

Thanks.
Mergedinto: 608163
Status: Duplicate (was: Assigned)
Project Member

Comment 3 by ClusterFuzz, May 3 2016

ClusterFuzz has detected this issue as fixed in range 390954:390990.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5762312731885568

Fuzzer: attekett_dom_fuzzer
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000080
Crash State:
  content::PPB_Graphics3D_Impl::ReturnFrontBuffer
  content::PepperPluginInstanceImpl::FinishedConsumingCommittedTexture
  base::internal::Invoker<base::IndexSequence<0u, 1u>, base::internal::BindState<b
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=390527:390610
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=390954:390990

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96gZc0bKS3DUagpepIj_wtECJOqos8UbCxIL9-hX0L_3nApX2dj7elHSr-QEotL-KUSY7cKXwK_O7vLspxVqvYyh7a8pgFhvTsM384iVI49GgbKOwX-n81QKnKkimBNqP9zkvnsZnMSl17e_4Z4RBPcwZ__tYamoQqE1rSBtLZYJ_OniK4


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment