Author: Olli Etuaho
Project: chromium-angle
Changelist: https://chromium.googlesource.com/angle/angle.git/+/4310354ebcaca62d4c16e2577e58a5148dffb877
Time: Mon Oct 10 11:28:13 2016
Lines 427-446 of file ConstantUnion.cpp which potentially caused crash are changed in this cl (frame #4, "TConstantUnion::rshift").
Minimum distance from crash line to modified line: 0. (file: ConstantUnion.cpp, crashed on: 427, modified: 427).

Suspected Project: chromium-angle
Suspected Component: Internals>GPU>ANGLE

Olli, can you take a look at this?  It can be reproduced by shifting with the left side being INT_MIN (-2147483648).  It hits some of the code that works around shifting negative numbers that I'm not familiar with.

Wrote a patch a few hours back: https://chromium-review.googlesource.com/#/c/408158/

Awesome, thanks

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/556442117bc373ddce148461c59b70f1250aced0

commit 556442117bc373ddce148461c59b70f1250aced0
Author: Olli Etuaho <oetuaho@nvidia.com>
Date: Tue Nov 08 11:07:34 2016

Fix constant folding right shift corner cases

Right-shifting the minimum signed integer needs to be handled as a
special case, since it can't go through the usual path that clears the
sign bit.

Code for right-shifting by zero also had a typo that resulted in
setting the wrong value to the result.

BUG= chromium:662706 
TEST=angle_unittests

Change-Id: Ief24d738064906a72212242e0917ce30e45d6b25
Reviewed-on: https://chromium-review.googlesource.com/408158
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Commit-Queue: Olli Etuaho <oetuaho@nvidia.com>

[modify] https://crrev.com/556442117bc373ddce148461c59b70f1250aced0/src/tests/compiler_tests/ConstantFolding_test.cpp
[modify] https://crrev.com/556442117bc373ddce148461c59b70f1250aced0/src/compiler/translator/ConstantUnion.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/211a037098c47829e10690dad696a6d047df5c8c

commit 211a037098c47829e10690dad696a6d047df5c8c
Author: zmo <zmo@chromium.org>
Date: Wed Nov 09 04:12:14 2016

Roll ANGLE e5c53e3..b7bf742

https://chromium.googlesource.com/angle/angle.git/+log/e5c53e3..b7bf742

BUG= chromium:639760 ,chromium:641129, chromium:662706 
TEST=bots
TBR=jmadill@chromium.org
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Review-Url: https://codereview.chromium.org/2486113002
Cr-Commit-Position: refs/heads/master@{#430854}

[modify] https://crrev.com/211a037098c47829e10690dad696a6d047df5c8c/DEPS

ClusterFuzz has detected this issue as fixed in range 430837:430879.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5241685027323904

Fuzzer: libfuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  lhsSafe > 0
  TConstantUnion::rshift
  TIntermConstantUnion::foldBinary
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=425319:425376
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=430837:430879

Minimized Testcase (0.77 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95-QzVLiF5GCXHS_VoTh9Qz1o7SyFYWNhRULOj262HD5wbFBWvKSClOYLrlfxIm-0yIfhDuJo0ZqaNKbKikrvHwRjW_7fW9yS2ve4ZnQfE57sVbeHFwz3Zhm4jP3IdzJGBquZv0q6HuWWHQKOctOjG6JLhsoQ?testcase_id=5241685027323904

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot