ASSERT: !node->getRight()->hasSideEffects() |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4721873056432128 Fuzzer: libfuzzer_angle_translator_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: !node->getRight()->hasSideEffects() sh::OutputHLSL::visitBinary sh::TIntermTraverser::traverseBinary Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=420312:420423 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4721873056432128 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
May 24 2017
I diagnosed the issue, it is caused by precision emulation inserting internal function call nodes in places where HLSL output asserts there are no side effects. Even though in reality there are no side effects, all aggregate nodes are currently assumed to have side effects, so the assert is triggered. One possible fix would be to simply remove the assert, but it might be feasible to do a cleaner fix than that without too much effort.
,
May 26 2017
The following revision refers to this bug: https://chromium.googlesource.com/angle/angle/+/a22aa4eda1d8b164887a22151da3d58f8f8943c7 commit a22aa4eda1d8b164887a22151da3d58f8f8943c7 Author: Olli Etuaho <oetuaho@nvidia.com> Date: Fri May 26 15:56:54 2017 Mark some internal functions as not having side effects Precision emulation rounding function calls and vector/matrix dynamic indexing function calls now get a flag that indicates that running the function body does not have side effects. This avoids triggering asserts in OutputHLSL when these internal function calls end up on the right hand side of a non-unfolded logical operator. BUG= chromium:724870 TEST=angle_unittests Change-Id: Id1a2b6b744f6a04c6cdb86a8f4109ccc12bc70b9 Reviewed-on: https://chromium-review.googlesource.com/516705 Reviewed-by: Jamie Madill <jmadill@chromium.org> Commit-Queue: Olli Etuaho <oetuaho@nvidia.com> [modify] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/compiler/translator/IntermNode.cpp [modify] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/tests/compiler_tests/DebugShaderPrecision_test.cpp [modify] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/tests/angle_unittests.gypi [modify] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/compiler/translator/IntermNode.h [modify] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/compiler/translator/EmulatePrecision.cpp [modify] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/compiler/translator/RemoveDynamicIndexing.cpp [add] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/tests/compiler_tests/HLSLOutput_test.cpp
,
May 29 2017
This issue should be fixed by the next ANGLE roll.
,
May 29 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/69d6bf0149b35dbe1bcd94d329b03a676e25401b commit 69d6bf0149b35dbe1bcd94d329b03a676e25401b Author: jmadill <jmadill@chromium.org> Date: Mon May 29 16:13:28 2017 Roll ANGLE ff77c35..7d79fe9 https://chromium.googlesource.com/angle/angle.git/+log/ff77c35..7d79fe9 BUG=722684, chromium:724870 TBR=geofflang@chromium.org TEST=bots CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel Review-Url: https://codereview.chromium.org/2906353002 Cr-Commit-Position: refs/heads/master@{#475359} [modify] https://crrev.com/69d6bf0149b35dbe1bcd94d329b03a676e25401b/DEPS
,
May 30 2017
ClusterFuzz has detected this issue as fixed in range 475351:475362. Detailed report: https://clusterfuzz.com/testcase?key=4721873056432128 Fuzzer: libfuzzer_angle_translator_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: !node->getRight()->hasSideEffects() sh::OutputHLSL::visitBinary sh::TIntermTraverser::traverseBinary Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=420312:420423 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=475351:475362 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4721873056432128 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
May 30 2017
ClusterFuzz testcase 4721873056432128 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by msrchandra@chromium.org
, May 23 2017Labels: Test-Predator-Wrong-CLs M-59
Owner: oetu...@nvidia.com
Status: Assigned (was: Untriaged)