This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

PTAL or send this to someone who can, thank you.

This is due to a limitation in clusterfuzz where it can't parse decltype declarations. I'm going to file an feature request for decltype support - but in the meantime I think this is not a security issue of any kind.

Correction, this is a limitation in ASAN. Etienne said he could help me out here.

I said: It may be a UBSAN limitation (not ASAN).
I'm gonna look to the exact case and try to repro.

I tried to repro with this snippet, but with LLVM ToT it seems fine.

==== module.h ====

#include <iostream>

void problemMember() {
  std::cout << "problemMember called!" << std::endl;
}

struct ProblemFns {
  decltype(&problemMember) member = problemMember;
};

// needs export labels
extern "C" __declspec(dllexport) ProblemFns *GetProblemFns();
using GetProblemFnsType = decltype(GetProblemFns);


==== module.cc ====

#include <windows.h>

#include "module.h"

static ProblemFns g_problemFns;

ProblemFns *GetProblemFns() {
  return &g_problemFns;
}


==== main.cc ====

#include <windows.h>

#include "module.h"

int main() {
  HMODULE dll = ::LoadLibrary("module.dll");
  auto getProblemFns = reinterpret_cast<GetProblemFnsType*>(
      ::GetProcAddress(dll, "GetProblemFns"));

  // error 1:
  auto problemFns = getProblemFns();

  // error 2:
  problemFns->member();
}



command-line:
d:\src\llvm\ninja64\bin\clang-cl.exe main.cc /Zi -fsanitize=undefined
d:\src\llvm\ninja64\bin\clang-cl.exe module.cc /LD /Zi -fsanitize=undefined


Running:
D:\src\llvm\examples>main.exe
problemMember called!

Detailed report: https://clusterfuzz.com/testcase?key=4722871158177792

Fuzzer: gpu_angle_fuzzer
Job Type: libfuzzer_chrome_ubsan
Crash Type: Incorrect-function-pointer-type
Crash Address: 
Crash State:
  egl::Display::initialize
  egl::Display::initialize
  egl::Initialize
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: Medium

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4722871158177792


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Detailed report: https://clusterfuzz.com/testcase?key=4722871158177792

Fuzzer: gpu_angle_fuzzer
Job Type: libfuzzer_chrome_ubsan
Crash Type: Incorrect-function-pointer-type
Crash Address: 
Crash State:
  egl::Display::initialize
  egl::Display::initialize
  egl::Initialize
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=452261:452420

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4722871158177792


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

A recommended severity was added to this bug. Please change the severity if it is inaccurate.

ClusterFuzz has detected this issue as fixed in range 500168:500210.

Detailed report: https://clusterfuzz.com/testcase?key=4722871158177792

Fuzzer: gpu_angle_fuzzer
Job Type: libfuzzer_chrome_ubsan
Crash Type: Incorrect-function-pointer-type
Crash Address: 
Crash State:
  egl::Display::initialize
  egl::Display::initialize
  egl::Initialize
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=452261:452420
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=500168:500210

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4722871158177792

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4722871158177792 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot