New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 660702 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Nov 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

lhs.IsValid() && rhs.IsValid()

Project Member Reported by ClusterFuzz, Oct 30 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4935007014748160

Fuzzer: libfuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  lhs.IsValid() && rhs.IsValid()
  float CheckedDiff<float>
  TConstantUnion::sub
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=420312:420423

Minimized Testcase (0.25 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97jRj-p6de1AXjE1xyLkStzU_E3Ld3jSdjlTaCJ4_GsRsMtJCei0-xdZEeLsUjvI1p8-u2Uc6e9V4lDGe9Q-F1HSazJUJHNE_QP5ov_d0Aa7f9ZB2xX5ZW7shRy5rN-czMcqTABn_u8Vg3OqtBid63sRTBEtA?testcase_id=4935007014748160

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Owner: jmad...@chromium.org
Status: Assigned (was: Untriaged)
jmadill@ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !
Cc: oetu...@nvidia.com cwallez@chromium.org
Components: Internals>GPU>ANGLE
Fuzzer bug. 
Labels: -Pri-1 Pri-2
Status: Started (was: Assigned)
Fix in review: https://chromium-review.googlesource.com/#/c/406268/

Not a real bug as far as I can see. It's a) only an ASSERT and b) not reproducible outside of fuzzing that I could find.
Project Member

Comment 4 by bugdroid1@chromium.org, Nov 1 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/cfe7b2c43e0c1bc4fd531a6d7f99fb7f2139a078

commit cfe7b2c43e0c1bc4fd531a6d7f99fb7f2139a078
Author: Jamie Madill <jmadill@chromium.org>
Date: Tue Nov 01 17:18:10 2016

Add finite check to lexer float constants.

The fuzzer was generating cases where floating point constants would
someone return as valid when they were beyond max float. I was unable
to reproduce this in a standalone test, but confirmed this check
fixes the fuzzer error.

BUG= 660702 

Change-Id: I9e6b883958013638ea509e38b30e812a9e74fbc1
Reviewed-on: https://chromium-review.googlesource.com/406268
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Jamie Madill <jmadill@chromium.org>

[modify] https://crrev.com/cfe7b2c43e0c1bc4fd531a6d7f99fb7f2139a078/src/compiler/preprocessor/numeric_lex.h

Project Member

Comment 5 by bugdroid1@chromium.org, Nov 1 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4b4caa8cb6a950c014ec8406f8a11797d9e72ddc

commit 4b4caa8cb6a950c014ec8406f8a11797d9e72ddc
Author: geofflang <geofflang@chromium.org>
Date: Tue Nov 01 20:36:43 2016

Roll ANGLE 60e6edf..eb66a6e

https://chromium.googlesource.com/angle/angle.git/+log/60e6edf..eb66a6e

BUG= 660702 

TBR=jmadill@chromium.org

TEST=bots

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Review-Url: https://codereview.chromium.org/2470893002
Cr-Commit-Position: refs/heads/master@{#429094}

[modify] https://crrev.com/4b4caa8cb6a950c014ec8406f8a11797d9e72ddc/DEPS

Project Member

Comment 6 by ClusterFuzz, Nov 2 2016

ClusterFuzz has detected this issue as fixed in range 428837:429212.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4935007014748160

Fuzzer: libfuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  lhs.IsValid() && rhs.IsValid()
  float CheckedDiff<float>
  TConstantUnion::sub
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=420312:420423
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=428837:429212

Minimized Testcase (0.25 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97jRj-p6de1AXjE1xyLkStzU_E3Ld3jSdjlTaCJ4_GsRsMtJCei0-xdZEeLsUjvI1p8-u2Uc6e9V4lDGe9Q-F1HSazJUJHNE_QP5ov_d0Aa7f9ZB2xX5ZW7shRy5rN-czMcqTABn_u8Vg3OqtBid63sRTBEtA?testcase_id=4935007014748160

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Nov 2 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 8 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment