New issue
Advanced search Search tips

Issue 609381 link

Starred by 0 users

Issue metadata

Status: Fixed
Owner:
Closed: May 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug-Regression



Sign in to add a comment

Crash in SkSurface::getCanvas

Project Member Reported by ClusterFuzz, May 5 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4752881558749184

Fuzzer: inferno_twister
Job Type: linux_asan_chrome_gpu
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000020
Crash State:
  SkSurface::getCanvas
  cc::SoftwareRenderer::ApplyImageFilter
  cc::SoftwareRenderer::DrawRenderPassQuad
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_gpu&range=172836:173286

Minimized Testcase (0.18 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95L-Du0I3K8k6kfYD8eLgqQb75tDLQskNJKNp6NKPMIhY7PJYwPpGvT6CcOBHZH9c85kGuUQ35_QSLBXR2Txh8SNrxuv-g9poMKz39-rPL2wnyHDs-EQkNhWQsa3gq93Ag_tSLemZKhDlVF3bVeGU7coluaTA
<svg>
    <filter id=zero-dst-tile>
<feTile width=0><style>img:not(testA) {
    transform: translatez(0)
<img src=resources/reference.png style="-webkit-filter: url(#zero-dst-tile);">


Filer: brajkumar

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Components: Blink>CSS>Filters
Labels: -Pri-1 -Type-Bug Te-Logged Pri-2 Type-Bug-Regression
Owner: tomhud...@chromium.org
Status: Assigned (was: Available)
Through code search on file "software_renderer.cc" from frame #2 suspecting the below change
Review URL: https://codereview.chromium.org/1869753003

tomhudson@ - Observed some recent changes on this file, so assigning to you. Could you please check if this is caused with respect to this change, if not please help us in reassign the issue to the right owner.

Thanks!
Owner: senorblanco@chromium.org
More likely a dupe of crbug.com/609061, fixed yesterday. Let's keep this open to see if ClusterFuzz agrees.
Nope, not a dupe (still repros in today's build).

Fix up here: https://codereview.chromium.org/1952303002/
Project Member

Comment 4 by bugdroid1@chromium.org, May 5 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d67155a66c554ec8cba4fc0f0f686847ddb34afd

commit d67155a66c554ec8cba4fc0f0f686847ddb34afd
Author: senorblanco <senorblanco@chromium.org>
Date: Thu May 05 21:32:46 2016

cc: fix nullptr deref in software renderer.

Check for an empty result rect (which should render nothing)
and a null filter (which should render the primitive
unfiltered) independently.

BUG= 609381 
CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel

Review-Url: https://codereview.chromium.org/1952303002
Cr-Commit-Position: refs/heads/master@{#391903}

[modify] https://crrev.com/d67155a66c554ec8cba4fc0f0f686847ddb34afd/cc/output/software_renderer.cc
[add] https://crrev.com/d67155a66c554ec8cba4fc0f0f686847ddb34afd/cc/test/data/white.png
[modify] https://crrev.com/d67155a66c554ec8cba4fc0f0f686847ddb34afd/cc/trees/layer_tree_host_pixeltest_filters.cc

Status: Fixed (was: Assigned)
Project Member

Comment 6 by ClusterFuzz, May 6 2016

ClusterFuzz has detected this issue as fixed in range 391873:391931.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4752881558749184

Fuzzer: inferno_twister
Job Type: linux_asan_chrome_gpu
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000020
Crash State:
  SkSurface::getCanvas
  cc::SoftwareRenderer::ApplyImageFilter
  cc::SoftwareRenderer::DrawRenderPassQuad
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_gpu&range=172836:173286
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_gpu&range=391873:391931

Minimized Testcase (0.18 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95L-Du0I3K8k6kfYD8eLgqQb75tDLQskNJKNp6NKPMIhY7PJYwPpGvT6CcOBHZH9c85kGuUQ35_QSLBXR2Txh8SNrxuv-g9poMKz39-rPL2wnyHDs-EQkNhWQsa3gq93Ag_tSLemZKhDlVF3bVeGU7coluaTA
<svg>
    <filter id=zero-dst-tile>
<feTile width=0><style>img:not(testA) {
    transform: translatez(0)
<img src=resources/reference.png style="-webkit-filter: url(#zero-dst-tile);">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 8 by suzyh@chromium.org, Apr 5 2017

Components: -Blink>CSS>Filters Blink>Compositing>Filters

Sign in to add a comment