New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 724870 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Email to this user bounced
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

ASSERT: !node->getRight()->hasSideEffects()

Project Member Reported by ClusterFuzz, May 21 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4721873056432128

Fuzzer: libfuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  !node->getRight()->hasSideEffects()
  sh::OutputHLSL::visitBinary
  sh::TIntermTraverser::traverseBinary
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=420312:420423

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4721873056432128


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong-CLs M-59
Owner: oetu...@nvidia.com
Status: Assigned (was: Untriaged)
Predator and CL did not provide any possible suspects.
Using Code Search for the file, "OutputHLSL.cpp" assigning to the concern owner who might be related.

@Olli Etuaho -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by oetu...@nvidia.com, May 24 2017

Components: Internals>GPU>ANGLE
I diagnosed the issue, it is caused by precision emulation inserting internal function call nodes in places where HLSL output asserts there are no side effects. Even though in reality there are no side effects, all aggregate nodes are currently assumed to have side effects, so the assert is triggered. One possible fix would be to simply remove the assert, but it might be feasible to do a cleaner fix than that without too much effort.
Project Member

Comment 3 by bugdroid1@chromium.org, May 26 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/a22aa4eda1d8b164887a22151da3d58f8f8943c7

commit a22aa4eda1d8b164887a22151da3d58f8f8943c7
Author: Olli Etuaho <oetuaho@nvidia.com>
Date: Fri May 26 15:56:54 2017

Mark some internal functions as not having side effects

Precision emulation rounding function calls and vector/matrix dynamic
indexing function calls now get a flag that indicates that running the
function body does not have side effects. This avoids triggering
asserts in OutputHLSL when these internal function calls end up on the
right hand side of a non-unfolded logical operator.

BUG= chromium:724870 
TEST=angle_unittests

Change-Id: Id1a2b6b744f6a04c6cdb86a8f4109ccc12bc70b9
Reviewed-on: https://chromium-review.googlesource.com/516705
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Commit-Queue: Olli Etuaho <oetuaho@nvidia.com>

[modify] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/compiler/translator/IntermNode.cpp
[modify] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/tests/compiler_tests/DebugShaderPrecision_test.cpp
[modify] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/tests/angle_unittests.gypi
[modify] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/compiler/translator/IntermNode.h
[modify] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/compiler/translator/EmulatePrecision.cpp
[modify] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/compiler/translator/RemoveDynamicIndexing.cpp
[add] https://crrev.com/a22aa4eda1d8b164887a22151da3d58f8f8943c7/src/tests/compiler_tests/HLSLOutput_test.cpp

Comment 4 by oetu...@nvidia.com, May 29 2017

This issue should be fixed by the next ANGLE roll.
Project Member

Comment 5 by bugdroid1@chromium.org, May 29 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/69d6bf0149b35dbe1bcd94d329b03a676e25401b

commit 69d6bf0149b35dbe1bcd94d329b03a676e25401b
Author: jmadill <jmadill@chromium.org>
Date: Mon May 29 16:13:28 2017

Roll ANGLE ff77c35..7d79fe9

https://chromium.googlesource.com/angle/angle.git/+log/ff77c35..7d79fe9

BUG=722684, chromium:724870 

TBR=geofflang@chromium.org

TEST=bots

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Review-Url: https://codereview.chromium.org/2906353002
Cr-Commit-Position: refs/heads/master@{#475359}

[modify] https://crrev.com/69d6bf0149b35dbe1bcd94d329b03a676e25401b/DEPS

Project Member

Comment 6 by ClusterFuzz, May 30 2017

ClusterFuzz has detected this issue as fixed in range 475351:475362.

Detailed report: https://clusterfuzz.com/testcase?key=4721873056432128

Fuzzer: libfuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  !node->getRight()->hasSideEffects()
  sh::OutputHLSL::visitBinary
  sh::TIntermTraverser::traverseBinary
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=420312:420423
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=475351:475362

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4721873056432128


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, May 30 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4721873056432128 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment