New issue
Advanced search Search tips

Issue 658589 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 658265
Owner:
Closed: Oct 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in setFramebufferBindingDirty

Project Member Reported by ClusterFuzz, Oct 23 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6072221137371136

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0x00000000000c
Crash State:
  setFramebufferBindingDirty
  blink::DrawingBuffer::createColorBuffer
  blink::DrawingBuffer::createOrRecycleColorBuffer
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=426648:426725

Minimized Testcase (6.66 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96d0n4kBI3slnm57WR5R6kf4NPVcXXSAA3J8yJiBjfIM1rzX4BFC-0PyPGVTe9VWLlI1f7paSDpbHqTKOXlBSRoYki1zsPTVMA8nZqt2f1bpfrpBZ_14QzmcX51dHBBR_r1UMkzAU7AERHLJPY7AP273C1zDA?testcase_id=6072221137371136

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Components: Blink>Paint
Labels: Test-Predator-Correct
Owner: ccameron@chromium.org
Status: Assigned (was: Untriaged)
Suspected CLs:
==============
The result is a list of CLs that change the crashed files.

Author: ccameron
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/123016bf9ed08d599540dddc9a3b92a0df7eba2e
Time: Fri Oct 21 02:05:50 2016
Lines 244, 343, 1115 of file DrawingBuffer.cpp which potentially caused crash are changed in this cl (frame #1, "blink::DrawingBuffer::createColorBuffer"; frame #3, "blink::DrawingBuffer::finishPrepareTextureMailboxGpu"; frame #5, "blink::DrawingBuffer::PrepareTextureMailbox").
Minimum distance from crash line to modified line: 0. (file: DrawingBuffer.cpp, crashed on: 343, modified: 343).

Suspected Project: chromium
Suspected Component: Blink>Paint

From the above CL list suspecting the below:
https://chromium.googlesource.com/chromium/src/+/123016bf9ed08d599540dddc9a3b92a0df7eba2e
ccameron@ : Could you please take a look into this if its related to your change.
Mergedinto: 658265
Status: Duplicate (was: Assigned)
I'm adding instrumentation in  issue 658265  to track this.
Project Member

Comment 3 by ClusterFuzz, Oct 25 2016

ClusterFuzz has detected this issue as fixed in range 427006:427199.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6072221137371136

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0x00000000000c
Crash State:
  setFramebufferBindingDirty
  blink::DrawingBuffer::createColorBuffer
  blink::DrawingBuffer::createOrRecycleColorBuffer
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=426648:426725
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=427006:427199

Minimized Testcase (6.66 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96d0n4kBI3slnm57WR5R6kf4NPVcXXSAA3J8yJiBjfIM1rzX4BFC-0PyPGVTe9VWLlI1f7paSDpbHqTKOXlBSRoYki1zsPTVMA8nZqt2f1bpfrpBZ_14QzmcX51dHBBR_r1UMkzAU7AERHLJPY7AP273C1zDA?testcase_id=6072221137371136

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment