Out-of-memory in translator_fuzzer |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5381550927773696 Fuzzer: libfuzzer_translator_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Out-of-memory Crash Address: Crash State: translator_fuzzer Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94-vDCHsI3DvHhscPSUw43d-TWmvUo9zauuuEv0Z05tHILS-84HJSgJ6FUyGDfjwAy8DrEo64QJZwNoby6zvbhhCM9gXAWAXNYfyDI3vQUkiQ5T1YGR-tGcXhaleGsC8CoLPM3BW-unjCn-hUW_JZD6o9yClA?testcase_id=5381550927773696 Issue manually filed by: mmoroz See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Sep 19 2016
,
Sep 19 2016
It is sort of expected behavior: the shader given as input does an explosion of macro expansion that causes creation of std::vector of 24'956'349 in size (that's just before it crashes on my machine). We could add an arbitrary limit, but there will be plenty of other ways to go OOM on our translator. How important is it to avoid OOM for ClusterFuzz?
,
Sep 20 2016
,
Sep 22 2016
The following revision refers to this bug: https://chromium.googlesource.com/angle/angle/+/2bd9c4430e68c7a67c52f1e2ab9f93ac6b12249d commit 2bd9c4430e68c7a67c52f1e2ab9f93ac6b12249d Author: Corentin Wallez <cwallez@chromium.org> Date: Tue Sep 20 20:39:18 2016 preprocessor: add a limit to the number of token expanded BUG= angleproject:1522 BUG= chromium:648074 Change-Id: Ibf0858aaeb81933dd221ac82a49160169b48a495 Reviewed-on: https://chromium-review.googlesource.com/387211 Reviewed-by: Geoff Lang <geofflang@chromium.org> Commit-Queue: Corentin Wallez <cwallez@chromium.org> [modify] https://crrev.com/2bd9c4430e68c7a67c52f1e2ab9f93ac6b12249d/src/compiler/preprocessor/MacroExpander.cpp [modify] https://crrev.com/2bd9c4430e68c7a67c52f1e2ab9f93ac6b12249d/src/compiler/preprocessor/MacroExpander.h
,
Sep 23 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/86dc7effdd78ad7aacdaf3af7fb8eb7e380e9f64 commit 86dc7effdd78ad7aacdaf3af7fb8eb7e380e9f64 Author: cwallez <cwallez@chromium.org> Date: Fri Sep 23 21:21:19 2016 Roll ANGLE c287ea6..28a97ee https://chromium.googlesource.com/angle/angle.git/+log/c287ea6..28a97ee BUG= chromium:648031 , chromium:648135 , 648063 , 607283 , 645532 , chromium:648074 TBR=geofflang@chromium.org TEST=bots CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel Merge branch 'master' of https://chromium.googlesource.com/chromium/src fuzzers: add a fuzzer for the ANGLE shader translator BUG= angleproject:1522 Review-Url: https://codereview.chromium.org/2364873003 Cr-Commit-Position: refs/heads/master@{#420732} [modify] https://crrev.com/86dc7effdd78ad7aacdaf3af7fb8eb7e380e9f64/DEPS
,
Sep 24 2016
ClusterFuzz has detected this issue as fixed in range 420114:420204. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5381550927773696 Fuzzer: libfuzzer_translator_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Out-of-memory Crash Address: Crash State: translator_fuzzer Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=420114:420204 Minimized Testcase (0.73 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94nr1BzmJHmV5bBksxnKBRJu3Y0XL70zRaZnrNe0PgsokZHTwniUxm3d9XzufqS8UVfrVBJceef18tZ3V6tGejR3eVttgKoH-7WhFocsW7iyrtIKkJQE9pkk52LDWa3gapf-DN_HullVY76LTUBvbhzJosC-w?testcase_id=5381550927773696 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 28 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by mmoroz@chromium.org
, Sep 18 2016Owner: cwallez@chromium.org