Crash in base::debug::DebugBreak |
|||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5585924693164032 Fuzzer: libfuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x03e900000261 Crash State: base::debug::DebugBreak gpu::gles2::GLES2DecoderImpl::ValidateUniformBlockBackings gpu::gles2::GLES2DecoderImpl::DoDrawArrays Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=429354:429425 Minimized Testcase (0.03 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97VFpua9HtFxNiH0Hfesz3oQ5Oqef-6r-ZtVjd_KDFFNaHocMz-uGp1hNzywT8g8qO5PqiVGB4ZHBazQ4e7l6KOd2fGoq5JXBHyO0v6TMhJ4gZ2lmoO1EuVhkscOqDVvMRlDhNI52X12fqVvsyg0HTUQL7Lew?testcase_id=5585924693164032 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Nov 3 2016
,
Nov 3 2016
,
Nov 3 2016
[1102/181753:FATAL:gles2_cmd_decoder.cc(8703)] Check failed: state_.current_program.get(). #0 0x00000046c271 __interceptor_backtrace #1 0x7fae98a3e06a base::debug::StackTrace::StackTrace() #2 0x7fae98be5013 logging::LogMessage::~LogMessage() #3 0x7fae99b7eb74 gpu::gles2::GLES2DecoderImpl::ValidateUniformBlockBackings() #4 0x7fae99b9b347 gpu::gles2::GLES2DecoderImpl::DoDrawArrays() #5 0x7fae99a57e8b gpu::gles2::GLES2DecoderImpl::HandleDrawArrays() #6 0x7fae99c15a25 gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<>() #7 0x7fae99b43d61 gpu::gles2::GLES2DecoderImpl::DoCommands() #8 0x7fae998fbadb gpu::CommandParser::ProcessCommands() #9 0x7fae999080e8 gpu::CommandExecutor::PutChanged() #10 0x0000004fba4a gpu::(anonymous namespace)::CommandBufferSetup::PumpCommands() #11 0x0000004fd83b _ZN4base8internal13FunctorTraitsIMN3gpu12_GLOBAL__N_118CommandBufferSetupEFvvEvE6InvokeIPS4_JEEEvS6_OT_DpOT0_ #12 0x0000004fd3ee _ZN4base8internal12InvokeHelperILb0EvE8MakeItSoIRKMN3gpu12_GLOBAL__N_118CommandBufferSetupEFvvEJPS6_EEEvOT_DpOT0_ #13 0x0000004fd16a _ZN4base8internal7InvokerINS0_9BindStateIMN3gpu12_GLOBAL__N_118CommandBufferSetupEFvvEJNS0_17UnretainedWrapperIS5_EEEEEFvvEE7RunImplIRKS7_RKNSt3__15tupleIJS9_EEEJLm0EEEEvOT_OT0_NS_13IndexSequenceIJXspT1_EEEE #14 0x0000004fcf45 _ZN4base8internal7InvokerINS0_9BindStateIMN3gpu12_GLOBAL__N_118CommandBufferSetupEFvvEJNS0_17UnretainedWrapperIS5_EEEEEFvvEE3RunEPNS0_13BindStateBaseE #15 0x7fae9990486f base::internal::RunMixin<>::Run() #16 0x7fae998ff5f9 gpu::CommandBufferService::Flush() #17 0x0000004f62eb gpu::(anonymous namespace)::CommandBufferSetup::RunCommandBuffer() #18 0x0000004f5ab4 LLVMFuzzerTestOneInput #19 0x00000056f1c9 fuzzer::Fuzzer::ExecuteCallback() #20 0x00000056fe0a fuzzer::Fuzzer::RunOne() #21 0x00000050dc6f fuzzer::RunOneTest() #22 0x000000514d6c fuzzer::FuzzerDriver() #23 0x000000598fbf main #24 0x7fae8e76fec5 __libc_start_main #25 0x000000420a65 <unknown>
,
Nov 3 2016
,
Nov 3 2016
,
Nov 3 2016
https://codereview.chromium.org/2475793002 should fix this.
,
Nov 3 2016
piman already uploaded a CL.
,
Nov 4 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/9dd9a266280b4f58cbe708e6d123db3dbccc1e46 commit 9dd9a266280b4f58cbe708e6d123db3dbccc1e46 Author: piman <piman@chromium.org> Date: Fri Nov 04 00:50:07 2016 Fix crash when drawing without a program BUG= 661868 CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel Review-Url: https://codereview.chromium.org/2475793002 Cr-Commit-Position: refs/heads/master@{#429743} [modify] https://crrev.com/9dd9a266280b4f58cbe708e6d123db3dbccc1e46/gpu/command_buffer/service/gles2_cmd_decoder.cc [modify] https://crrev.com/9dd9a266280b4f58cbe708e6d123db3dbccc1e46/gpu/command_buffer/service/gles2_cmd_decoder_unittest_drawing.cc
,
Nov 4 2016
ClusterFuzz has detected this issue as fixed in range 429695:429743. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5585924693164032 Fuzzer: libfuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x03e900000261 Crash State: base::debug::DebugBreak gpu::gles2::GLES2DecoderImpl::ValidateUniformBlockBackings gpu::gles2::GLES2DecoderImpl::DoDrawArrays Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=429354:429425 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=429695:429743 Minimized Testcase (0.03 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97VFpua9HtFxNiH0Hfesz3oQ5Oqef-6r-ZtVjd_KDFFNaHocMz-uGp1hNzywT8g8qO5PqiVGB4ZHBazQ4e7l6KOd2fGoq5JXBHyO0v6TMhJ4gZ2lmoO1EuVhkscOqDVvMRlDhNI52X12fqVvsyg0HTUQL7Lew?testcase_id=5585924693164032 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 4 2016
ClusterFuzz testcase is verified as fixed, closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by msrchandra@chromium.org
, Nov 3 2016Components: Internals>GPU
Labels: Findit-for-crash Test-Predator-Correct
Owner: zmo@chromium.org
Status: Assigned (was: Untriaged)