New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 732023 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jun 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in rewind

Project Member Reported by ClusterFuzz, Jun 10 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5039277800161280

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000028
Crash State:
  rewind
  merge_edges_below
  merge_collinear_edges
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=477544:477573

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5039277800161280


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: msrchandra@chromium.org
Components: Internals>GPU>Rasterization
Labels: M-61 Test-Predator-Correct-CLs
Owner: senorblanco@chromium.org
Status: Assigned (was: Untriaged)
Assigning to the concern owner from Predator results --
The result is a list of CLs that change the crashed files. 

Author: Stephen White
Project: chromium-skia
Changelist: https://skia.googlesource.com/skia.git/+/3b5a3fa8b1c11d4bd4499b040311f4c3553ebf8c
Time: Tue Jun 06 14:51:19 2017 -0400
Lines 876-903, 971-979, 1129-1137, 1289-1298, 1304-1305 of file GrTessellator.cpp which potentially caused crash are changed in this cl (frame #0, ""; frame #1, ""; frame #3, ""; frame #4, "").
Minimum distance from crash line to modified line: 0. (file: GrTessellator.cpp, crashed on: 1129, modified: 1129).

@Stephen White -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Project Member

Comment 2 by bugdroid1@chromium.org, Jun 12 2017

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/e3a0be73a61147379ab0ce33a0e773c072c47908

commit e3a0be73a61147379ab0ce33a0e773c072c47908
Author: Stephen White <senorblanco@chromium.org>
Date: Mon Jun 12 17:44:23 2017

GrTessellator: fix two NaN issues.

If a point in the path rounds to +inf/-inf, the intersection code can
produce NaN, which is unsortable. Fix: ignore non-finite intersections.

Quadratic interpolation can sometimes produce NaN, which will never
satisfy the flatness criterion. Abort if any of the interpolated points
are non-finite.

Bug:732023
Change-Id: If5881796e589c75b8f74459f42d00918619713a2
Reviewed-on: https://skia-review.googlesource.com/19467
Reviewed-by: Brian Salomon <bsalomon@google.com>
Commit-Queue: Stephen White <senorblanco@chromium.org>

[modify] https://crrev.com/e3a0be73a61147379ab0ce33a0e773c072c47908/tests/TessellatingPathRendererTests.cpp
[modify] https://crrev.com/e3a0be73a61147379ab0ce33a0e773c072c47908/src/gpu/GrTessellator.cpp

Project Member

Comment 3 by ClusterFuzz, Jun 12 2017

Labels: OS-Linux
Status: Fixed (was: Assigned)
Project Member

Comment 5 by ClusterFuzz, Jun 20 2017

ClusterFuzz has detected this issue as fixed in range 478717:478791.

Detailed report: https://clusterfuzz.com/testcase?key=5039277800161280

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000028
Crash State:
  rewind
  merge_edges_below
  merge_collinear_edges
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=477544:477573
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=478717:478791

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5039277800161280


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Jun 20 2017

ClusterFuzz has detected this issue as fixed in range 478717:478791.

Detailed report: https://clusterfuzz.com/testcase?key=5039277800161280

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000028
Crash State:
  rewind
  merge_edges_below
  merge_collinear_edges
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=477544:477573
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=478717:478791

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5039277800161280


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment