New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 648074 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Sep 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Out-of-memory in translator_fuzzer

Project Member Reported by ClusterFuzz, Sep 18 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5381550927773696

Fuzzer: libfuzzer_translator_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Out-of-memory
Crash Address: 
Crash State:
  translator_fuzzer
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94-vDCHsI3DvHhscPSUw43d-TWmvUo9zauuuEv0Z05tHILS-84HJSgJ6FUyGDfjwAy8DrEo64QJZwNoby6zvbhhCM9gXAWAXNYfyDI3vQUkiQ5T1YGR-tGcXhaleGsC8CoLPM3BW-unjCn-hUW_JZD6o9yClA?testcase_id=5381550927773696


Issue manually filed by: mmoroz

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 

Comment 1 by mmoroz@chromium.org, Sep 18 2016

Cc: mmoroz@chromium.org kcc@chromium.org aizatsky@chromium.org
Owner: cwallez@chromium.org
Out-of-memory with <1KB input. Not sure if this is a bug or an expected behavior.

Comment 2 by mmoroz@chromium.org, Sep 19 2016

Components: Internals>GPU>ANGLE
It is sort of expected behavior: the shader given as input does an explosion of macro expansion that causes creation of std::vector of 24'956'349 in size (that's just before it crashes on my machine).

We could add an arbitrary limit, but there will be plenty of other ways to go OOM on our translator. How important is it to avoid OOM for ClusterFuzz?
Status: Available (was: Untriaged)
Project Member

Comment 5 by bugdroid1@chromium.org, Sep 22 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/2bd9c4430e68c7a67c52f1e2ab9f93ac6b12249d

commit 2bd9c4430e68c7a67c52f1e2ab9f93ac6b12249d
Author: Corentin Wallez <cwallez@chromium.org>
Date: Tue Sep 20 20:39:18 2016

preprocessor: add a limit to the number of token expanded

BUG= angleproject:1522 
BUG= chromium:648074 

Change-Id: Ibf0858aaeb81933dd221ac82a49160169b48a495
Reviewed-on: https://chromium-review.googlesource.com/387211
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Commit-Queue: Corentin Wallez <cwallez@chromium.org>

[modify] https://crrev.com/2bd9c4430e68c7a67c52f1e2ab9f93ac6b12249d/src/compiler/preprocessor/MacroExpander.cpp
[modify] https://crrev.com/2bd9c4430e68c7a67c52f1e2ab9f93ac6b12249d/src/compiler/preprocessor/MacroExpander.h

Project Member

Comment 6 by bugdroid1@chromium.org, Sep 23 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/86dc7effdd78ad7aacdaf3af7fb8eb7e380e9f64

commit 86dc7effdd78ad7aacdaf3af7fb8eb7e380e9f64
Author: cwallez <cwallez@chromium.org>
Date: Fri Sep 23 21:21:19 2016

Roll ANGLE c287ea6..28a97ee

https://chromium.googlesource.com/angle/angle.git/+log/c287ea6..28a97ee

BUG= chromium:648031 , chromium:648135 , 648063 , 607283 , 645532 , chromium:648074 

TBR=geofflang@chromium.org

TEST=bots

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Merge branch 'master' of https://chromium.googlesource.com/chromium/src

fuzzers: add a fuzzer for the ANGLE shader translator

BUG= angleproject:1522 

Review-Url: https://codereview.chromium.org/2364873003
Cr-Commit-Position: refs/heads/master@{#420732}

[modify] https://crrev.com/86dc7effdd78ad7aacdaf3af7fb8eb7e380e9f64/DEPS

Project Member

Comment 7 by ClusterFuzz, Sep 24 2016

ClusterFuzz has detected this issue as fixed in range 420114:420204.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5381550927773696

Fuzzer: libfuzzer_translator_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Out-of-memory
Crash Address: 
Crash State:
  translator_fuzzer
  
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_msan&range=420114:420204

Minimized Testcase (0.73 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94nr1BzmJHmV5bBksxnKBRJu3Y0XL70zRaZnrNe0PgsokZHTwniUxm3d9XzufqS8UVfrVBJceef18tZ3V6tGejR3eVttgKoH-7WhFocsW7iyrtIKkJQE9pkk52LDWa3gapf-DN_HullVY76LTUBvbhzJosC-w?testcase_id=5381550927773696

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Status: Fixed (was: Available)
Project Member

Comment 9 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment