New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 662800 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Nov 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in SkAAClip::Builder::addAntiRectRun

Project Member Reported by ClusterFuzz, Nov 7 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6113486750089216

Fuzzer: inferno_twister_custom_bundle
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000004
Crash State:
  SkAAClip::Builder::addAntiRectRun
  SkAAClip::BuilderBlitter::blitAntiRect
  SkScan::aaa_fill_path
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=430188:430191

Minimized Testcase (0.39 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97TO7Wq9EXTG6xf0qtUCbAyX4JNlSzjlbd6oQOj5_3XgK8jgXTj7NmKnhURNWxe3hVZERo6aSUdddf1rIOaH0531vuG60_dSVCCEHyqKVO9RbA5PbbpHemfORTL3tSWw8SuJYPFT1jUQm1rAvNm4sDRQ85JXA?testcase_id=6113486750089216

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: nyerramilli@chromium.org reed@chromium.org
Components: Internals>Skia
Labels: Test-Predator-Wrong-CLs M-56
Owner: bsalomon@chromium.org
Status: Assigned (was: Untriaged)
providing Findit results for internal purpose:

Git blame below is NOT necessarily who introduced the crash nor the owner for it. Please check the code before assigning to anyone.(No CL in the regression range changed the crashing files.) 

Author: reed@google.com
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/9154eb08ec1f0d51688a6eb55c54111cf6ec5fbb
Time: Mon Oct 31 16:07:28 2011 +0000
The CL last changed line 1182 of file SkAAClip.cpp, which is stack frame 0. 

Author: reed@google.com
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/9154eb08ec1f0d51688a6eb55c54111cf6ec5fbb
Time: Mon Oct 31 16:07:28 2011 +0000
The CL last changed line 1069 of file SkAAClip.cpp, which is stack frame 1. 

Author: tomhudson@google.com
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/49eac192faa35159752525b23345563252721c64
Time: Tue Dec 27 13:59:20 2011 +0000
The CL last changed line 1306 of file SkAAClip.cpp, which is stack frame 2. 

Author: liyuqian
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/38911a7cb53474575e1cd1cb545902b50ee00889
Time: Tue Oct 04 11:23:22 2016 -0700
The CL last changed line 1001 of file SkScan_AAAPath.cpp, which is stack frame 3. 

Author: liyuqian
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/38911a7cb53474575e1cd1cb545902b50ee00889
Time: Tue Oct 04 11:23:22 2016 -0700
The CL last changed line 1205 of file SkScan_AAAPath.cpp, which is stack frame 4. 

Author: liyuqian
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/2add0ffdaab4c33ca6702c81533c88c7b5ca7294
Time: Thu Oct 20 11:04:39 2016 -0700
The CL last changed line 1323 of file SkScan_AAAPath.cpp, which is stack frame 5. 

Author: liyuqian
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/2add0ffdaab4c33ca6702c81533c88c7b5ca7294
Time: Thu Oct 20 11:04:39 2016 -0700
The CL last changed line 1415 of file SkAAClip.cpp, which is stack frame 6.

assigning to skia owners, requesting to check the issue and update.


Cc: bsalomon@chromium.org
Owner: reed@chromium.org

Comment 3 by hcm@chromium.org, Nov 7 2016

Cc: -reed@chromium.org reed@google.com
Owner: liyuqian@chromium.org
Project Member

Comment 4 by ClusterFuzz, Nov 8 2016

ClusterFuzz has detected this issue as fixed in range 430262:430287.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6113486750089216

Fuzzer: inferno_twister_custom_bundle
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000004
Crash State:
  SkAAClip::Builder::addAntiRectRun
  SkAAClip::BuilderBlitter::blitAntiRect
  SkScan::aaa_fill_path
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=430188:430191
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=430262:430287

Minimized Testcase (0.39 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97TO7Wq9EXTG6xf0qtUCbAyX4JNlSzjlbd6oQOj5_3XgK8jgXTj7NmKnhURNWxe3hVZERo6aSUdddf1rIOaH0531vuG60_dSVCCEHyqKVO9RbA5PbbpHemfORTL3tSWw8SuJYPFT1jUQm1rAvNm4sDRQ85JXA?testcase_id=6113486750089216

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Nov 8 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Status: Assigned (was: Verified)
Status: Started (was: Assigned)
https://codereview.chromium.org/2490673002/
Project Member

Comment 9 by bugdroid1@chromium.org, Nov 9 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/297c8ab49a4cebe2c6a6b4d0162d89433fefa863

commit 297c8ab49a4cebe2c6a6b4d0162d89433fefa863
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Tue Nov 08 23:59:21 2016

Roll src/third_party/skia/ dbdf6d210..562e681e5 (3 commits).

https://skia.googlesource.com/skia.git/+log/dbdf6d210b7e..562e681e5c60

$ git log dbdf6d210..562e681e5 --date=short --no-merges --format='%ad %ae %s'
2016-11-08 msarett Refactor RGBA/BGRA xform logic in SkCodecs
2016-11-08 liyuqian Relax the extra span's alpha
2016-11-08 liyuqian Do not call blitAntiRect for empty rect

BUG= 662800 

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel
TBR=scroggo@google.com

Review-Url: https://codereview.chromium.org/2482333002
Cr-Commit-Position: refs/heads/master@{#430775}

[modify] https://crrev.com/297c8ab49a4cebe2c6a6b4d0162d89433fefa863/DEPS

Status: Fixed (was: Started)
Project Member

Comment 11 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment