New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 683631 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Email to this user bounced
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in walk_convex_edges

Project Member Reported by ClusterFuzz, Jan 22 2017

Issue description

Cc: msrchandra@chromium.org
Components: Internals>Skia
Labels: Test-Predator-Correct-CLs
Owner: reed@chromium.org
Status: Assigned (was: Untriaged)
From find it results assigning to the concern owner --
Regression information is not available. The result is the blame information. 

Author: reed@google.com
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/e3a83ec4e5c0abd2f5b756d7a6e7d58515969f18
Time: Tue Oct 25 19:27:43 2011 +0000
The CL last changed line 314 of file SkScan_Path.cpp, which is stack frame 0. 

Author: halcanary
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/96fcdcc219d2a0d3579719b84b28bede76efba64
Time: Thu Aug 27 07:41:13 2015 -0700
The CL last changed line 508 of file SkScan_Path.cpp, which is stack frame 1. 

Author: Yuqian Li
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/e4b8b5283f45cff6a490ee73677f75b641c22bd1
Time: Wed Nov 16 10:12:58 2016 -0500
The CL last changed line 707 of file SkScan_Path.cpp, which is stack frame 2. 

Author: reed@google.com
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/1ba7137fc0dcace0c1be1367fe977202c63746ba
Time: Wed Oct 12 20:42:05 2011 +0000
The CL last changed line 745 of file SkScan_AntiPath.cpp, which is stack frame 3. 

Author: reed
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/82595b6fa4733e1525f357bdcac22db058790550
Time: Mon May 09 17:48:46 2016 -0700
The CL last changed line 1096 of file SkDraw.cpp, which is stack frame 4. 

Author: reed
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/82595b6fa4733e1525f357bdcac22db058790550
Time: Mon May 09 17:48:46 2016 -0700
The CL last changed line 1189 of file SkDraw.cpp, which is stack frame 5. 

Author: reed@google.com
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/126f7f5244502c0cbf1e5fec1d2ad7a0f2eb6c34
Time: Thu Nov 07 16:06:53 2013 +0000
The CL last changed line 54 of file SkDraw.h, which is stack frame 6.

@reed -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Project Member

Comment 2 by bugdroid1@chromium.org, Jan 27 2017

The following revision refers to this bug:
  https://skia.googlesource.com/skia.git/+/c121a8849cf6d1d535e69fc3836c5720e0372a28

commit c121a8849cf6d1d535e69fc3836c5720e0372a28
Author: Mike Reed <reed@google.com>
Date: Fri Jan 27 16:59:07 2017

give up on big cubics (for now) and just draw a line

BUG= 683631 , skia:6152

Change-Id: I69aa741af74a37e1d7bed25ad0401535599f6af0
Reviewed-on: https://skia-review.googlesource.com/7659
Reviewed-by: Cary Clark <caryclark@google.com>
Commit-Queue: Mike Reed <reed@google.com>

[modify] https://crrev.com/c121a8849cf6d1d535e69fc3836c5720e0372a28/src/core/SkEdgeClipper.cpp
[modify] https://crrev.com/c121a8849cf6d1d535e69fc3836c5720e0372a28/tests/PathTest.cpp

Project Member

Comment 3 by bugdroid1@chromium.org, Jan 27 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/72d0e68daf64b2c1a18fedb4be520c2fa183c734

commit 72d0e68daf64b2c1a18fedb4be520c2fa183c734
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Fri Jan 27 20:07:42 2017

Roll src/third_party/skia/ 587e08f36..c121a8849 (7 commits).

https://skia.googlesource.com/skia.git/+log/587e08f361ee..c121a8849cf6

$ git log 587e08f36..c121a8849 --date=short --no-merges --format='%ad %ae %s'
2017-01-27 reed give up on big cubics (for now) and just draw a line
2017-01-27 halcanary SkTScopedComPtr: implicit nullptr cast to SkTScopedComPtr<T>()
2017-01-27 fmalita Remove SkBlitter:resetShaderContext()
2017-01-27 halcanary tools/git-sync-deps improvements
2017-01-27 robertphillips Add utilities to create GrSurfaceProxy & GrSurfaceContext from backend descs
2017-01-27 fmalita Raster pipeline support for SkLocalMatrixShader composition
2017-01-24 egdaniel Add offset to uniform blocks in Vulkan

BUG= 683631 

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel
TBR=ethannicholas@google.com

Review-Url: https://codereview.chromium.org/2657103003
Cr-Commit-Position: refs/heads/master@{#446742}

[modify] https://crrev.com/72d0e68daf64b2c1a18fedb4be520c2fa183c734/DEPS

Project Member

Comment 4 by ClusterFuzz, Jan 28 2017

ClusterFuzz has detected this issue as fixed in range 446675:446784.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6169226537861120

Fuzzer: libfuzzer_skia_path_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000018
Crash State:
  walk_convex_edges
  sk_fill_path
  SkScan::FillPath
  
Sanitizer: address (ASAN)

Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=446675:446784

Minimized Testcase (0.08 Kb): https://cluster-fuzz.appspot.com/download/AMIfv9501eQBQiFRHxG_sZrNPmPwOucTJSReQGY2MOnQeU-lwuyms074YAReQ1f7kYlRUy3mcFTjIoCyCubkl3M_pYG-66bSELwCo-qWtzKT35udG0nY4vV8MWvzhCsbGxWoYwrptVpB7CWldccJxZXVbuhGUdbKQdNFuh9F6lbAIT3PZXA3pcOwB4n15UDyUeTYFmPJ3OHODjv1kymr4hlJpeLMS4K2uTk0cL5AZ9wZRvSnuR2T7k6t4vade-Cvro3ztIrgH17Y8ZJj6vcz-YBvocHWi3NM5TxaINjA-8F5VdBVIftfXNwM3wCwZhdX915Z3WKm1ZAr6EJG6kjFkbZbu2dRjj9oaw31HO3HIJNm8hyfW9iXrxE?testcase_id=6169226537861120

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Jan 28 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6169226537861120 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment