New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 648068 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Sep 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in next

Project Member Reported by ClusterFuzz, Sep 18 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4604184664211456

Fuzzer: libfuzzer_skia_pathop_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000018
Crash State:
  next
  SkOpSpanBase::contains
  ordered
  

Minimized Testcase (0.49 Kb): https://cluster-fuzz.appspot.com/download/AMIfv951hfHk5DM4I8uh9AX6GR4PHtfShpQKRvSK6f5d6hUvZdKuuPXH8ky-g4gYvsNjQzMGuT9d2JGtU10Owv6cPUI7jzD8Y0856zDO2fffxAFovHqTgH-exjxNUmKlY3TyAX_wH307O6VyJcofeDXxREGsCc-SQg?testcase_id=4604184664211456

Issue manually filed by: mmoroz

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 

Comment 1 by mmoroz@chromium.org, Sep 18 2016

Cc: mmoroz@chromium.org mbarbe...@chromium.org kcc@chromium.org aizatsky@chromium.org
Components: Internals>Skia
Owner: caryclark@chromium.org
Looks similar to  bug 644640 , but this one is reproducible.

caryclark@, could you please help to triage?
Project Member

Comment 2 by bugdroid1@chromium.org, Sep 19 2016

The following revision refers to this bug:
  https://skia.googlesource.com/skia.git/+/bbfe92bc1dd2b0a65e63b3caed9873dbc4df522a

commit bbfe92bc1dd2b0a65e63b3caed9873dbc4df522a
Author: caryclark <caryclark@google.com>
Date: Mon Sep 19 13:00:35 2016

fix fuzzer bugs

Add a couple more cases where Op() fails and
returns false when the out of range input
values make the internal numeric unstable.

TBR=reed@google.com
BUG= 647834 ,  648068 
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2348263002

Review-Url: https://codereview.chromium.org/2348263002

[modify] https://crrev.com/bbfe92bc1dd2b0a65e63b3caed9873dbc4df522a/src/pathops/SkOpCoincidence.cpp
[modify] https://crrev.com/bbfe92bc1dd2b0a65e63b3caed9873dbc4df522a/tests/PathOpsOpTest.cpp

Owner: caryclark@google.com
Status: Started (was: Untriaged)
Project Member

Comment 4 by bugdroid1@chromium.org, Sep 19 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c7397ecfff60fda69006f5cb837a99468fa4e6ca

commit c7397ecfff60fda69006f5cb837a99468fa4e6ca
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Mon Sep 19 13:58:02 2016

Roll src/third_party/skia/ e7a781274..bbfe92bc1 (1 commit).

https://chromium.googlesource.com/skia.git/+log/e7a7812744c2..bbfe92bc1dd2

$ git log e7a781274..bbfe92bc1 --date=short --no-merges --format='%ad %ae %s'
2016-09-19 caryclark fix fuzzer bugs

BUG= 647834 , 648068 

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel
TBR=borenet@google.com

Review-Url: https://codereview.chromium.org/2343413002
Cr-Commit-Position: refs/heads/master@{#419448}

[modify] https://crrev.com/c7397ecfff60fda69006f5cb837a99468fa4e6ca/DEPS

Status: Fixed (was: Started)
Project Member

Comment 6 by ClusterFuzz, Sep 21 2016

ClusterFuzz has detected this issue as fixed in range 419434:419468.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4604184664211456

Fuzzer: libfuzzer_skia_pathop_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000018
Crash State:
  next
  SkOpSpanBase::contains
  ordered
  
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=419434:419468

Minimized Testcase (0.49 Kb): https://cluster-fuzz.appspot.com/download/AMIfv951hfHk5DM4I8uh9AX6GR4PHtfShpQKRvSK6f5d6hUvZdKuuPXH8ky-g4gYvsNjQzMGuT9d2JGtU10Owv6cPUI7jzD8Y0856zDO2fffxAFovHqTgH-exjxNUmKlY3TyAX_wH307O6VyJcofeDXxREGsCc-SQg?testcase_id=4604184664211456

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment