lhs.IsValid() && rhs.IsValid() |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4935007014748160 Fuzzer: libfuzzer_angle_translator_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: lhs.IsValid() && rhs.IsValid() float CheckedDiff<float> TConstantUnion::sub Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=420312:420423 Minimized Testcase (0.25 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97jRj-p6de1AXjE1xyLkStzU_E3Ld3jSdjlTaCJ4_GsRsMtJCei0-xdZEeLsUjvI1p8-u2Uc6e9V4lDGe9Q-F1HSazJUJHNE_QP5ov_d0Aa7f9ZB2xX5ZW7shRy5rN-czMcqTABn_u8Vg3OqtBid63sRTBEtA?testcase_id=4935007014748160 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Oct 31 2016
Fuzzer bug.
,
Nov 1 2016
Fix in review: https://chromium-review.googlesource.com/#/c/406268/ Not a real bug as far as I can see. It's a) only an ASSERT and b) not reproducible outside of fuzzing that I could find.
,
Nov 1 2016
The following revision refers to this bug: https://chromium.googlesource.com/angle/angle/+/cfe7b2c43e0c1bc4fd531a6d7f99fb7f2139a078 commit cfe7b2c43e0c1bc4fd531a6d7f99fb7f2139a078 Author: Jamie Madill <jmadill@chromium.org> Date: Tue Nov 01 17:18:10 2016 Add finite check to lexer float constants. The fuzzer was generating cases where floating point constants would someone return as valid when they were beyond max float. I was unable to reproduce this in a standalone test, but confirmed this check fixes the fuzzer error. BUG= 660702 Change-Id: I9e6b883958013638ea509e38b30e812a9e74fbc1 Reviewed-on: https://chromium-review.googlesource.com/406268 Reviewed-by: Corentin Wallez <cwallez@chromium.org> Commit-Queue: Jamie Madill <jmadill@chromium.org> [modify] https://crrev.com/cfe7b2c43e0c1bc4fd531a6d7f99fb7f2139a078/src/compiler/preprocessor/numeric_lex.h
,
Nov 1 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/4b4caa8cb6a950c014ec8406f8a11797d9e72ddc commit 4b4caa8cb6a950c014ec8406f8a11797d9e72ddc Author: geofflang <geofflang@chromium.org> Date: Tue Nov 01 20:36:43 2016 Roll ANGLE 60e6edf..eb66a6e https://chromium.googlesource.com/angle/angle.git/+log/60e6edf..eb66a6e BUG= 660702 TBR=jmadill@chromium.org TEST=bots CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel Review-Url: https://codereview.chromium.org/2470893002 Cr-Commit-Position: refs/heads/master@{#429094} [modify] https://crrev.com/4b4caa8cb6a950c014ec8406f8a11797d9e72ddc/DEPS
,
Nov 2 2016
ClusterFuzz has detected this issue as fixed in range 428837:429212. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4935007014748160 Fuzzer: libfuzzer_angle_translator_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: lhs.IsValid() && rhs.IsValid() float CheckedDiff<float> TConstantUnion::sub Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=420312:420423 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=428837:429212 Minimized Testcase (0.25 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97jRj-p6de1AXjE1xyLkStzU_E3Ld3jSdjlTaCJ4_GsRsMtJCei0-xdZEeLsUjvI1p8-u2Uc6e9V4lDGe9Q-F1HSazJUJHNE_QP5ov_d0Aa7f9ZB2xX5ZW7shRy5rN-czMcqTABn_u8Vg3OqtBid63sRTBEtA?testcase_id=4935007014748160 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 2 2016
ClusterFuzz testcase is verified as fixed, closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by mmohammad@chromium.org
, Oct 31 2016Status: Assigned (was: Untriaged)