New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 638783 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Aug 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug

Blocked on:
issue 638913



Sign in to add a comment

Crash in containsCoincidence

Project Member Reported by ClusterFuzz, Aug 17 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6335411276480512

Fuzzer: libfuzzer_skia_pathop_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000005e
Crash State:
  containsCoincidence
  insertCoincidence
  SkOpCoincidence::mark
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=405990:406128

Minimized Testcase (0.37 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96SxgxlLdGeGLNfRsEpr0BsxzAirHBjhbMj5zEgMqFgW624vJcfQ5LtH3YklH3Vjtrbae9f9-z-npLteQaP8BmSKWE5mHJEWtlvhfyuu4uXRb7L7IG0ml2mJKd1YsCJN_aZJiq_OfH7UHGodVfQI6KGpTW4cg?testcase_id=6335411276480512

Issue manually filed by: mummareddy

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Components: Internals>Skia
Labels: Findit-for-crash Te-Logged M-53
Owner: caryclark@chromium.org
Status: Assigned (was: Untriaged)
From findit tool:	

Author: caryclark
Project: chromium-skia
Changelist: https://chromium.googlesource.com/skia.git/+/55888e44171ffd48b591d19256884a969fe4da17
Time: Mon Jul 18 17:01:36 2016
Lines 523-545 of file SkPathOpsCommon.cpp which potentially caused crash are changed in this cl (frame #3, "HandleCoincidence").

Lines 312, 322 of file SkPathOpsOp.cpp which potentially caused crash are changed in this cl (frame #4, "OpDebug").

Lines 1381 of file SkOpCoincidence.cpp which potentially caused crash are changed in this cl (frame #2, "SkOpCoincidence::mark").

File SkOpBuilder.cpp is changed in this cl (and is part of stack frame #5, "SkOpBuilder::resolve")
Minimum distance from crash line to modified line: 0. (file: SkPathOpsCommon.cpp, crashed on: 523, modified: 523).

Suspected Project: chromium-skia
Suspected Component: Internals>Skia
Blockedon: 638913
Owner: caryclark@google.com
Project Member

Comment 5 by bugdroid1@chromium.org, Aug 19 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/997cb2361b5ee40e717978ae375e19dbb94200ce

commit 997cb2361b5ee40e717978ae375e19dbb94200ce
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Fri Aug 19 15:17:13 2016

Roll src/third_party/skia/ 83b24ff08..429428660 (1 commit).

https://chromium.googlesource.com/skia.git/+log/83b24ff0825e..429428660b24

$ git log 83b24ff08..429428660 --date=short --no-merges --format='%ad %ae %s'
2016-08-19 caryclark fix fuzzes

BUG= 639157 , 638783 

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel
TBR=robertphillips@google.com

Review-Url: https://codereview.chromium.org/2258173002
Cr-Commit-Position: refs/heads/master@{#413149}

[modify] https://crrev.com/997cb2361b5ee40e717978ae375e19dbb94200ce/DEPS

Status: Fixed (was: Assigned)
Project Member

Comment 7 by ClusterFuzz, Aug 25 2016

ClusterFuzz has detected this issue as fixed in range 414042:414068.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6335411276480512

Fuzzer: libfuzzer_skia_pathop_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000005e
Crash State:
  containsCoincidence
  insertCoincidence
  SkOpCoincidence::mark
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=405990:406128
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=414042:414068

Minimized Testcase (0.37 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96SxgxlLdGeGLNfRsEpr0BsxzAirHBjhbMj5zEgMqFgW624vJcfQ5LtH3YklH3Vjtrbae9f9-z-npLteQaP8BmSKWE5mHJEWtlvhfyuu4uXRb7L7IG0ml2mJKd1YsCJN_aZJiq_OfH7UHGodVfQI6KGpTW4cg?testcase_id=6335411276480512

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment