New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 675618 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Last visit > 30 days ago
Closed: Dec 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Float-cast-overflow in AlmostDequalUlps

Project Member Reported by ClusterFuzz, Dec 19 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4924362701668352

Fuzzer: inferno_webbot
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  AlmostDequalUlps
  SkDCubic::RootsReal
  SkDCubic::RootsValidT
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=435261:438085

Minimized Testcase (0.07 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94vLPu9GkM3WuPKtF0b1UVLH_MWrpR2urMdvGXlmtvKmGoAzOkVCIzue0ZPgV0PFjS7mUC7TsDfDm-kEsfcw1855UTfnMWJAfL4Dhx8i_xXUVN5Fa573UlynKmJbFLajY5WDbYbjIVFipqqWTvOk6Wm3TGPQQ?testcase_id=4924362701668352
<script>
window.location = "http://keukenmachineshop.nl";</script></html>


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: msrchandra@chromium.org
Components: Internals>Skia
Labels: Test-Predator-Correct-CLs
Owner: caryclark@chromium.org
Status: Assigned (was: Untriaged)
Assigning to the concern from Find it. Below is the find it result --
The result is a list of CLs that change the crashed files. 

Author: Cary Clark
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/7eb01e00b1a1f7c649e1e78eb3f4644033ce94ee
Time: Thu Dec 08 14:36:32 2016 -0500
File SkPathOpsCubic.cpp is changed in this cl (and is part of stack frame #1, "SkDCubic::RootsReal"; frame #2, "SkDCubic::RootsValidT")
Minimum distance from crash line to modified line: 49. (file: SkPathOpsCubic.cpp, crashed on: 379, modified: 330).

@Cary Clark -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Status: WontFix (was: Assigned)
If the double is not in the range of a float, then there is no expected result. 

The out of range double becomes +/- Infinity, and will not create a downstream problem.

Should I file a separate bug 'Float-cast-overflow generated by fuzzers are not actionable bugs'?
Project Member

Comment 3 by ClusterFuzz, Dec 22 2016

ClusterFuzz has detected this issue as fixed in range 440242:440280.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4924362701668352

Fuzzer: inferno_webbot
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  AlmostDequalUlps
  SkDCubic::RootsReal
  SkDCubic::RootsValidT
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=435261:438085
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=440242:440280

Minimized Testcase (0.07 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94vLPu9GkM3WuPKtF0b1UVLH_MWrpR2urMdvGXlmtvKmGoAzOkVCIzue0ZPgV0PFjS7mUC7TsDfDm-kEsfcw1855UTfnMWJAfL4Dhx8i_xXUVN5Fa573UlynKmJbFLajY5WDbYbjIVFipqqWTvOk6Wm3TGPQQ?testcase_id=4924362701668352
<script>
window.location = "http://keukenmachineshop.nl";</script></html>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment