New issue
Advanced search Search tips

Issue 659494 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 658265
Owner:
Closed: Oct 2016
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

!m_drawingBuffer->m_stateRestorer in DrawingBuffer.cpp

Project Member Reported by ClusterFuzz, Oct 26 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5849038600798208

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !m_drawingBuffer->m_stateRestorer in DrawingBuffer.cpp
  blink::DrawingBuffer::resolveAndBindForReadAndDraw
  blink::WebGLRenderingContextBase::paintRenderingResultsToCanvas
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_chrome&range=427174:427199

Minimized Testcase (6.66 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97hYuaqXLRpvqWzX02L-iN657rcgH5noTLK9bORzTZOKdXNbRPZJY_VTZ_RQFN-DxrpzWt2tOWRjcggvHd-k2hZqpUU70ukNDWP7ntjVr7_9hJ1UAHqq66ItyU8Q9wqAva0qVvWZxv-8I4l0e0Jb9hpBcRl-w?testcase_id=5849038600798208

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Owner: ccameron@chromium.org
Status: Assigned (was: Untriaged)
ccameron@ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !
Recording the stack for posterity. Spinning a patch that fixes the issue

#0 0x7fe23c1839e0 __interceptor_backtrace
#1 0x7fe246561492 base::debug::StackTrace::StackTrace()
#2 0x7fe2465f7e5d logging::LogMessage::~LogMessage()
#3 0x7fe260b77f71 blink::DrawingBuffer::resolveAndBindForReadAndDraw()
#4 0x7fe25ad05b4b blink::WebGLRenderingContextBase::paintRenderingResultsToCanvas()
#5 0x7fe2566b258a blink::HTMLCanvasElement::getSourceImageForCanvas()
#6 0x7fe2566af1d1 blink::HTMLCanvasElement::notifyListenersCanvasChanged()
#7 0x7fe260b65530 blink::DrawingBuffer::prepareTextureMailboxInternal()
#8 0x7fe260b64e49 blink::DrawingBuffer::PrepareTextureMailbox()
#9 0x7fe25e95def3 cc::TextureLayer::Update()
#10 0x7fe24b5dd430 cc::LayerTree::UpdateLayers()
#11 0x7fe25ea96eb4 cc::LayerTreeHostInProcess::DoUpdateLayers()
#12 0x7fe25ea9596f cc::LayerTreeHostInProcess::UpdateLayers()
#13 0x7fe25eaa598b cc::ProxyMain::BeginMainFrame()
Mergedinto: 658265
Status: Duplicate (was: Assigned)
Project Member

Comment 4 by ClusterFuzz, Oct 29 2016

ClusterFuzz has detected this issue as fixed in range 428077:428329.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5849038600798208

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !m_drawingBuffer->m_stateRestorer in DrawingBuffer.cpp
  blink::DrawingBuffer::resolveAndBindForReadAndDraw
  blink::WebGLRenderingContextBase::paintRenderingResultsToCanvas
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_chrome&range=427174:427199
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_chrome&range=428077:428329

Minimized Testcase (6.66 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97hYuaqXLRpvqWzX02L-iN657rcgH5noTLK9bORzTZOKdXNbRPZJY_VTZ_RQFN-DxrpzWt2tOWRjcggvHd-k2hZqpUU70ukNDWP7ntjVr7_9hJ1UAHqq66ItyU8Q9wqAva0qVvWZxv-8I4l0e0Jb9hpBcRl-w?testcase_id=5849038600798208

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
I think this is now fixed.
Project Member

Comment 6 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment