New issue
Advanced search Search tips

Issue 653276 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Oct 2016
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Crash in getId

Project Member Reported by ClusterFuzz, Oct 5 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4838705305223168

Fuzzer: libfuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000078
Crash State:
  getId
  sh::OutputHLSL::handleExcessiveLoop
  sh::OutputHLSL::visitLoop
  

Minimized Testcase (0.52 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94GMRCEKWjXiEmRTAIvYu2AA_-91VFNtjbaJycmyuYA9-at7vBJlOjXtspAM4Jedo3ZT1sYubX1KSkQcdk3YCD2qgPQQZ4zs7WSIdolup3EqtcHwHXpf6lRGrt1bEwKYt5zZxwhNXi89pmXN_xtEtxB3jG2Tw?testcase_id=4838705305223168

Issue manually filed by: mmohammad

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Owner: jmad...@chromium.org
Status: Assigned (was: Untriaged)
jmadill@ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !
Labels: -Pri-1 Pri-2
Status: Started (was: Assigned)
Fix underway. I don't think this is exposed in Chrome.
Project Member

Comment 3 by bugdroid1@chromium.org, Oct 6 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/d569619d7d708ee920112980753777cfda6c7bfc

commit d569619d7d708ee920112980753777cfda6c7bfc
Author: Jamie Madill <jmadill@chromium.org>
Date: Thu Oct 06 15:09:24 2016

translator: Fail compilation if precision emu unsupported.

The fuzzer uncovered a case where we were trying to emulate precision
on HLSL 3.0, causing an ASSERT crash.

BUG= chromium:653276 

Change-Id: I2e666a1ff4f605541e25f04264146063559cb835
Reviewed-on: https://chromium-review.googlesource.com/394237
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Olli Etuaho <oetuaho@nvidia.com>
Commit-Queue: Jamie Madill <jmadill@chromium.org>

[modify] https://crrev.com/d569619d7d708ee920112980753777cfda6c7bfc/src/compiler/translator/Compiler.cpp
[modify] https://crrev.com/d569619d7d708ee920112980753777cfda6c7bfc/src/tests/compiler_tests/DebugShaderPrecision_test.cpp
[modify] https://crrev.com/d569619d7d708ee920112980753777cfda6c7bfc/src/compiler/translator/EmulatePrecision.h
[modify] https://crrev.com/d569619d7d708ee920112980753777cfda6c7bfc/src/compiler/translator/EmulatePrecision.cpp

Project Member

Comment 4 by bugdroid1@chromium.org, Oct 6 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/d569619d7d708ee920112980753777cfda6c7bfc

commit d569619d7d708ee920112980753777cfda6c7bfc
Author: Jamie Madill <jmadill@chromium.org>
Date: Thu Oct 06 15:09:24 2016

translator: Fail compilation if precision emu unsupported.

The fuzzer uncovered a case where we were trying to emulate precision
on HLSL 3.0, causing an ASSERT crash.

BUG= chromium:653276 

Change-Id: I2e666a1ff4f605541e25f04264146063559cb835
Reviewed-on: https://chromium-review.googlesource.com/394237
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Olli Etuaho <oetuaho@nvidia.com>
Commit-Queue: Jamie Madill <jmadill@chromium.org>

[modify] https://crrev.com/d569619d7d708ee920112980753777cfda6c7bfc/src/compiler/translator/Compiler.cpp
[modify] https://crrev.com/d569619d7d708ee920112980753777cfda6c7bfc/src/tests/compiler_tests/DebugShaderPrecision_test.cpp
[modify] https://crrev.com/d569619d7d708ee920112980753777cfda6c7bfc/src/compiler/translator/EmulatePrecision.h
[modify] https://crrev.com/d569619d7d708ee920112980753777cfda6c7bfc/src/compiler/translator/EmulatePrecision.cpp

Project Member

Comment 5 by bugdroid1@chromium.org, Oct 6 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9859aac71e6b077f66c37da16896971a81c02e08

commit 9859aac71e6b077f66c37da16896971a81c02e08
Author: jmadill <jmadill@chromium.org>
Date: Thu Oct 06 20:11:14 2016

Roll ANGLE d08f3b3..873d00f

https://chromium.googlesource.com/angle/angle.git/+log/d08f3b3..873d00f

BUG= chromium:653274 , chromium:651493 , chromium:653276 , chromium:593024 , chromium:634525 

TBR=geofflang@chromium.org

TEST=bots

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Review-Url: https://codereview.chromium.org/2399933002
Cr-Commit-Position: refs/heads/master@{#423643}

[modify] https://crrev.com/9859aac71e6b077f66c37da16896971a81c02e08/DEPS

Status: Fixed (was: Started)
Project Member

Comment 7 by ClusterFuzz, Oct 7 2016

ClusterFuzz has detected this issue as fixed in range 423381:423433.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4838705305223168

Fuzzer: libfuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000078
Crash State:
  getId
  sh::OutputHLSL::handleExcessiveLoop
  sh::OutputHLSL::visitLoop
  
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=423381:423433

Minimized Testcase (0.52 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94GMRCEKWjXiEmRTAIvYu2AA_-91VFNtjbaJycmyuYA9-at7vBJlOjXtspAM4Jedo3ZT1sYubX1KSkQcdk3YCD2qgPQQZ4zs7WSIdolup3EqtcHwHXpf6lRGrt1bEwKYt5zZxwhNXi89pmXN_xtEtxB3jG2Tw?testcase_id=4838705305223168

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by bugdroid1@chromium.org, Oct 27 2016

Labels: merge-merged-2840
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9859aac71e6b077f66c37da16896971a81c02e08

commit 9859aac71e6b077f66c37da16896971a81c02e08
Author: jmadill <jmadill@chromium.org>
Date: Thu Oct 06 20:11:14 2016

Roll ANGLE d08f3b3..873d00f

https://chromium.googlesource.com/angle/angle.git/+log/d08f3b3..873d00f

BUG= chromium:653274 , chromium:651493 , chromium:653276 , chromium:593024 , chromium:634525 

TBR=geofflang@chromium.org

TEST=bots

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Review-Url: https://codereview.chromium.org/2399933002
Cr-Commit-Position: refs/heads/master@{#423643}

[modify] https://crrev.com/9859aac71e6b077f66c37da16896971a81c02e08/DEPS

Comment 9 by dimu@google.com, Nov 4 2016

Labels: -merge-merged-2840
[Automated comment] removing mislabelled merge-merged-2840
Project Member

Comment 10 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment