[ mac bug triage ]

Tentatively tagging Blink>WebGL, please fix if incorrect.

The crash seems from the driver (is it osmesa?), not from Chrome.

Google search results for gldRenderFillPolygonPtr seem to indicate it's a Mac GL driver. Do these run on real hardware?

There's no WebGL in this test case. It looks like it's creating some huge clip path which might be causing a large framebuffer to be allocated and fail to allocate, or similar.

ClusterFuzz has detected this issue as fixed in range 486222:486253.

Detailed report: https://clusterfuzz.com/testcase?key=5784141529612288

Fuzzer: ifratric-browserfuzzer-v3
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Bus
Crash Address: 0x62910010e1e0
Crash State:
  gldRenderFillPolygonPtr
  gleFlushAtomicFunc
  glDrawElements_IMM_GL3Exec
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=463718:463770
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=486222:486253

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5784141529612288


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5784141529612288 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.