New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 644684 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Sep 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in SkOpCoincidence::addIfMissing

Project Member Reported by ClusterFuzz, Sep 7 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5466225285267456

Fuzzer: afl_skia_pathop_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  SkOpCoincidence::addIfMissing
  SkOpCoincidence::addMissing
  HandleCoincidence
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=416652:416734

Minimized Testcase (0.31 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96mzMI9Zll4flZuEzpbs36VHZKsmvN_sZs76e426Honw1KwXh1GqjrwMWUSBWjeqs-psNIUgZoIlpOU69ri--k4yyg0sOP_ZrSHrejBRYQ4rIVs_qsj9zdWwXstQ2l42NaW6MYEGCRVYjDXFZJBRJqbaUaMNw?testcase_id=5466225285267456

Issue manually filed by: mmoroz

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: mmoroz@chromium.org kcc@chromium.org reed@chromium.org aizatsky@chromium.org
Components: Internals>Skia
Owner: caryclark@chromium.org
Owner: caryclark@google.com
Project Member

Comment 3 by bugdroid1@chromium.org, Sep 7 2016

The following revision refers to this bug:
  https://skia.googlesource.com/skia.git/+/b393a49e5fa7e69ba67692929e9fa2a4e1f6bbb1

commit b393a49e5fa7e69ba67692929e9fa2a4e1f6bbb1
Author: caryclark <caryclark@google.com>
Date: Wed Sep 07 15:21:09 2016

fix pathops fuzzers

Extreme values trigger asserts that in range
values allow.

Disable asserts and other tests to prevent
extreme values from crashing.

TBR=reed@google.com
BUG= 644684 . 644680, 644640
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2316173002

Review-Url: https://codereview.chromium.org/2316173002

[modify] https://crrev.com/b393a49e5fa7e69ba67692929e9fa2a4e1f6bbb1/src/pathops/SkOpCoincidence.cpp
[modify] https://crrev.com/b393a49e5fa7e69ba67692929e9fa2a4e1f6bbb1/src/pathops/SkOpSpan.cpp
[modify] https://crrev.com/b393a49e5fa7e69ba67692929e9fa2a4e1f6bbb1/tests/PathOpsOpTest.cpp

Project Member

Comment 4 by bugdroid1@chromium.org, Sep 7 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7f6184789ba869b655dc251dbaedc8848fad4d11

commit 7f6184789ba869b655dc251dbaedc8848fad4d11
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Wed Sep 07 18:35:42 2016

Roll src/third_party/skia/ 5d8f69f2d..5edf2908a (7 commits).

https://chromium.googlesource.com/skia.git/+log/5d8f69f2d492..5edf2908a305

$ git log 5d8f69f2d..5edf2908a --date=short --no-merges --format='%ad %ae %s'
2016-09-07 halcanary SkPDF: remove unused fallback clipping code
2016-09-07 borenet Run install-sysroot script before 'gn gen' on PDFium bot
2016-09-07 robertphillips Revert of Make AALinearizingConvexPathRenderer able to handle stroke and fill (patchset #7 id:120001 of https://codereview.chromium.org/2301353004/ )
2016-09-07 caryclark fix pathops fuzzers
2016-09-07 brianosman Add color gamut xform helpers to GrGLSLShaderBuilder
2016-09-07 mtklein GN: fontmgr_custom
2016-09-07 vjiaoblack made point light shadows

BUG= 644684 . 644680,644640

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel
TBR=caryclark@google.com

Review-Url: https://codereview.chromium.org/2319693002
Cr-Commit-Position: refs/heads/master@{#417005}

[modify] https://crrev.com/7f6184789ba869b655dc251dbaedc8848fad4d11/DEPS

Project Member

Comment 5 by ClusterFuzz, Sep 8 2016

ClusterFuzz has detected this issue as fixed in range 416934:417009.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5466225285267456

Fuzzer: afl_skia_pathop_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  SkOpCoincidence::addIfMissing
  SkOpCoincidence::addMissing
  HandleCoincidence
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=416652:416734
Fixed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=416934:417009

Minimized Testcase (0.31 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96mzMI9Zll4flZuEzpbs36VHZKsmvN_sZs76e426Honw1KwXh1GqjrwMWUSBWjeqs-psNIUgZoIlpOU69ri--k4yyg0sOP_ZrSHrejBRYQ4rIVs_qsj9zdWwXstQ2l42NaW6MYEGCRVYjDXFZJBRJqbaUaMNw?testcase_id=5466225285267456

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Sep 8 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5516798088970240

Fuzzer: afl_skia_pathop_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  SkOpCoincidence::addIfMissing
  SkOpCoincidence::addMissing
  HandleCoincidence
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=416934:417009

Minimized Testcase (0.36 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95YuPxe5b6bA13YdW9pv0bcVJyY20iImIalIUMhRp2BgTWAjvW3fA0Kvz-mpDCBD4GWi7gN5FqdDnOHjNtnsQckszoU4OinMabRu0d6nNx-FQRuASam8IG3795Ite72b3r4ZKzfuCGmKw3YsgauZjPfBsNtLA?testcase_id=5516798088970240

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
Project Member

Comment 7 by bugdroid1@chromium.org, Sep 9 2016

The following revision refers to this bug:
  https://skia.googlesource.com/skia.git/+/c9b90d15df5fcee848812fbab3d714aba9e41e69

commit c9b90d15df5fcee848812fbab3d714aba9e41e69
Author: caryclark <caryclark@google.com>
Date: Fri Sep 09 14:41:36 2016

fix fuzzer

Earlier fix aborted coincident loop on wrong condition.
This aborts only when it reaches the end, and then
propagates the error out correctly.

TBR=reed@google.com
BUG= 644680 ,  644684 
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2327053002

Review-Url: https://codereview.chromium.org/2327053002

[modify] https://crrev.com/c9b90d15df5fcee848812fbab3d714aba9e41e69/src/pathops/SkOpCoincidence.cpp
[modify] https://crrev.com/c9b90d15df5fcee848812fbab3d714aba9e41e69/tests/PathOpsOpTest.cpp

Status: Started (was: Untriaged)
Project Member

Comment 9 by bugdroid1@chromium.org, Sep 9 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/30b35debcf3fb31f08d1c25b1d19819b81c8997b

commit 30b35debcf3fb31f08d1c25b1d19819b81c8997b
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Fri Sep 09 16:03:55 2016

Roll src/third_party/skia/ a42405aa5..55bcc8e0a (2 commits).

https://chromium.googlesource.com/skia.git/+log/a42405aa522c..55bcc8e0af34

$ git log a42405aa5..55bcc8e0a --date=short --no-merges --format='%ad %ae %s'
2016-09-09 msarett Delete some LUTs from SkColorSpaceXform
2016-09-09 caryclark fix fuzzer

BUG= 644680 , 644684 

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel
TBR=caryclark@google.com

Review-Url: https://codereview.chromium.org/2325133003
Cr-Commit-Position: refs/heads/master@{#417595}

[modify] https://crrev.com/30b35debcf3fb31f08d1c25b1d19819b81c8997b/DEPS

Project Member

Comment 10 by ClusterFuzz, Sep 10 2016

ClusterFuzz has detected this issue as fixed in range 417581:417681.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5516798088970240

Fuzzer: afl_skia_pathop_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  SkOpCoincidence::addIfMissing
  SkOpCoincidence::addMissing
  HandleCoincidence
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=416934:417009
Fixed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=417581:417681

Minimized Testcase (0.36 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95YuPxe5b6bA13YdW9pv0bcVJyY20iImIalIUMhRp2BgTWAjvW3fA0Kvz-mpDCBD4GWi7gN5FqdDnOHjNtnsQckszoU4OinMabRu0d6nNx-FQRuASam8IG3795Ite72b3r4ZKzfuCGmKw3YsgauZjPfBsNtLA?testcase_id=5516798088970240

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Sep 10 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 12 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment