New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 680323 link

Starred by 2 users

Issue metadata

Status: Duplicate
Merged: issue 681641
Owner:
OOO until 2019-01-24
Closed: Feb 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug



Sign in to add a comment

init_two_cube_map_levels_before_copyteximage triggers a heap-buffer-overflow in Mac ASAN GPU bot

Project Member Reported by zmo@chromium.org, Jan 12 2017

Issue description

==8901==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200009e351 at pc 0x0001019764a0 bp 0x7fff5e2d3410 sp 0x7fff5e2d2bb8
READ of size 4 at 0x60200009e351 thread T0
==8901==WARNING: invalid path to external symbolizer!
==8901==WARNING: Failed to use and restart external symbolizer!
#0 0x10197649f in __asan_memmove (/b/s/w/irnZMksE/out/Release/Chromium.app/Contents/Versions/57.0.2979.0/Chromium Helper.app/Contents/MacOS/libclang_rt.asan_osx_dynamic.dylib+0x4e49f)
#1 0x7fffadbae8c6 in glgProcessPixelsWithProcessor (/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib+0x78c6)
#2 0x7fffae85e034 in gleTextureImagePut (/System/Library/Frameworks/OpenGL.framework/Versions/A/Resources/GLEngine.bundle/GLEngine+0x14c034)
#3 0x7fffae72bc01 in glTexImage2D_Exec (/System/Library/Frameworks/OpenGL.framework/Versions/A/Resources/GLEngine.bundle/GLEngine+0x19c01)
#4 0x7fffadb9e46c in glTexImage2D (/System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib+0x346c)
#5 0x10d83215f in gl::(anonymous namespace)::CustomTexImage2D(unsigned int, int, int, int, int, int, unsigned int, unsigned int, void const*) (/b/s/w/irnZMksE/out/Release/Chromium.app/Contents/Versions/57.0.2979.0/Chromium Framework.framework/Chromium Framework+0x883815f)
#6 0x10d7cf09f in gl::GLApiBase::glTexImage2DFn(unsigned int, int, int, int, int, int, unsigned int, unsigned int, void const*) (/b/s/w/irnZMksE/out/Release/Chromium.app/Contents/Versions/57.0.2979.0/Chromium Framework.framework/Chromium Framework+0x87d509f)
#7 0x10db6d506 in gpu::gles2::TextureManager::DoTexImage(gpu::gles2::DecoderTextureState*, gpu::gles2::ContextState*, gpu::gles2::DecoderFramebufferState*, char const*, gpu::gles2::TextureRef*, gpu::gles2::TextureManager::DoTexImageArguments const&) (/b/s/w/irnZMksE/out/Release/Chromium.app/Contents/Versions/57.0.2979.0/Chromium Framework.framework/Chromium Framework+0x8b73506)
#8 0x10db6c25b in gpu::gles2::TextureManager::DoCubeMapWorkaround(gpu::gles2::DecoderTextureState*, gpu::gles2::ContextState*, gpu::gles2::DecoderFramebufferState*, gpu::gles2::TextureRef*, char const*, gpu::gles2::TextureManager::DoTexImageArguments const&) (/b/s/w/irnZMksE/out/Release/Chromium.app/Contents/Versions/57.0.2979.0/Chromium Framework.framework/Chromium Framework+0x8b7225b)
#9 0x10d9f50c3 in gpu::gles2::GLES2DecoderImpl::DoCopyTexImage2D(unsigned int, int, unsigned int, int, int, int, int, int) (/b/s/w/irnZMksE/out/Release/Chromium.app/Contents/Versions/57.0.2979.0/Chromium Framework.framework/Chromium Framework+0x89fb0c3)
#10 0x10d90c7bb in gpu::gles2::GLES2DecoderImpl::HandleCopyTexImage2D(unsigned int, void const volatile*) (/b/s/w/irnZMksE/out/Release/Chromium.app/Contents/Versions/57.0.2979.0/Chromium Framework.framework/Chromium Framework+0x89127bb)
 

Comment 1 by zmo@chromium.org, Jan 12 2017

This is triggered by kbr upgrading the Mac ASAN GPU bot from 10.10 to 10.12, from which a GPU driver bug workaround (init_two_cube_map_levels_before_copyteximage added by qiankun recently) is triggered.

I am confused at the stack.  It seems ASAN caught an overflow inside the driver?  How do we do that and how do we proceed to diagnose this overflow?  Any advice is appreciated.

Comment 3 by enne@chromium.org, Jan 30 2017

Owner: kbr@chromium.org
Status: Assigned (was: Available)
Giving this P1 bug a default owner to triage.

Comment 5 by kbr@chromium.org, Feb 8 2017

Mergedinto: 681641
Status: Duplicate (was: Assigned)
Thanks, agreed.

Components: -Internals>GPU>WebGL Blink>WebGL

Sign in to add a comment