New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 675091 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Email to this user bounced
Closed: Feb 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Data race in SkPath::transform

Project Member Reported by ClusterFuzz, Dec 16 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4904368068624384

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 1
Crash Address: 0x7b60000048f5
Crash State:
  SkPath::transform
  SkDraw::drawPath
  SkBitmapDevice::drawPath
  

Minimized Testcase (7.00 Kb): https://cluster-fuzz.appspot.com/download/AMIfv941RB86DF77NnwrzjXjQA5Unoc2CcDuD7uxMx0waa8dKuEv52LxpPHa51KoixOdmu_lNnTNVghjycYZygMlhHTJJ7wM40fmU-3iaWS7JLp89_PED186caEwBcsDP6sS5gH7O2NimMRzZo7hRX-crg-wUlQHkw?testcase_id=4904368068624384

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: msrchandra@chromium.org
Components: Internals>Skia
Labels: Test-Predator-Correct-CLs
Owner: reed@chromium.org
Status: Assigned (was: Untriaged)
Assigning to concern owner from Find it results --
Regression information is not available. The result is the blame information. 

Author: reed@google.com
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/2a6f8abf35ff8c2640c24478d9d2eaedff5e78ea
Time: Tue Oct 25 18:41:23 2011 +0000
The CL last changed line 1733 of file SkPath.cpp, which is stack frame 0. 

Author: reed@android.com
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/8a1c16ff38322f0210116fa7293eb8817c7e477e
Time: Wed Dec 17 15:59:43 2008 +0000
The CL last changed line 1187 of file SkDraw.cpp, which is stack frame 1. 

Author: reed@google.com
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/126f7f5244502c0cbf1e5fec1d2ad7a0f2eb6c34
Time: Thu Nov 07 16:06:53 2013 +0000
The CL last changed line 54 of file SkDraw.h, which is stack frame 2. 

Author: reed@google.com
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/4e2b3d3fb1288c6dc0f3ea1c0aa4a0d7c603bd7b
Time: Thu Apr 07 14:18:59 2011 +0000
The CL last changed line 2291 of file SkCanvas.cpp, which is stack frame 3. 

Author: reed
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/41af966ab338e95eee81ab618ab28195075338f7
Time: Mon Jan 05 07:49:08 2015 -0800
The CL last changed line 1881 of file SkCanvas.cpp, which is stack frame 4. 

Author: commit-bot@chromium.org
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/73b55eb7d789549ee9d6602ed96d2d9b74f3c6e3
Time: Mon Apr 14 20:35:12 2014 +0000
The CL last changed line 118 of file SkRecordDraw.cpp, which is stack frame 5. 

Author: mtklein
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/343a63d082bda969d7e8a4e09ba850e931185269
Time: Tue Mar 22 11:46:53 2016 -0700
The CL last changed line 51 of file SkRecord.h, which is stack frame 6.

@reed -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Project Member

Comment 2 by ClusterFuzz, Feb 12 2017

ClusterFuzz has detected this issue as fixed in range 449862:449870.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4904368068624384

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 1
Crash Address: 0x7b60000048f5
Crash State:
  SkPath::transform
  SkDraw::drawPath
  SkBitmapDevice::drawPath
  
Sanitizer: thread (TSAN)

Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=449862:449870

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv941RB86DF77NnwrzjXjQA5Unoc2CcDuD7uxMx0waa8dKuEv52LxpPHa51KoixOdmu_lNnTNVghjycYZygMlhHTJJ7wM40fmU-3iaWS7JLp89_PED186caEwBcsDP6sS5gH7O2NimMRzZo7hRX-crg-wUlQHkw?testcase_id=4904368068624384


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 3 by ClusterFuzz, Feb 12 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4904368068624384 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment