New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 732739 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Jul 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Indirect-leak in Ice::VariableDeclaration* Ice::VariableDeclarationList::allocate_variable_declar

Project Member Reported by ClusterFuzz, Jun 13 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4935196783935488

Fuzzer: libFuzzer_gpu_swiftshader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Indirect-leak
Crash Address: 
Crash State:
  Ice::VariableDeclaration* Ice::VariableDeclarationList::allocate_variable_declar
  Ice::VariableDeclaration::create
  sw::Nucleus::createConstantVector
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=478745:478819

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4935196783935488


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong-CLs M-61
Owner: capn@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL did not provide any possible suspects.
Using Code Search for the file, "IceDefs.h" assigning to the concern owner.
Suspecting Commit#
https://swiftshader.googlesource.com/SwiftShader.git/+/b8afba1c92fb10e54ca7984c46a480b29f300628

@capn -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by capn@chromium.org, Jul 5 2017

Status: Started (was: Assigned)
Project Member

Comment 3 by bugdroid1@chromium.org, Jul 5 2017

The following revision refers to this bug:
  https://swiftshader.googlesource.com/SwiftShader.git/+/83a6bb93fd825b975161546ff92d6fb77a7a9c22

commit 83a6bb93fd825b975161546ff92d6fb77a7a9c22
Author: Nicolas Capens <capn@google.com>
Date: Wed Jul 05 19:16:05 2017

Fix memory leak of Subzero global inits.

getGlobalInits() moves ownership of a unique_ptr<>, which we released
to obtain the raw pointer, but we didn't delete it afterwards. This is
fixed by keeping the unique_ptr<> and having it freed at the end of the
scope.

 Bug chromium:732739 

Change-Id: I4d8c9367f34790944daabc0417af08eb4b4c7c2e
Reviewed-on: https://swiftshader-review.googlesource.com/10409
Tested-by: Nicolas Capens <capn@google.com>
Reviewed-by: Alexis Hétu <sugoi@google.com>
Reviewed-by: Nicolas Capens <capn@google.com>

[modify] https://crrev.com/83a6bb93fd825b975161546ff92d6fb77a7a9c22/src/Reactor/SubzeroReactor.cpp

Project Member

Comment 4 by bugdroid1@chromium.org, Jul 5 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e9be2af23b67c48d8e92201b8eee0e47ea725a6e

commit e9be2af23b67c48d8e92201b8eee0e47ea725a6e
Author: capn <capn@chromium.org>
Date: Wed Jul 05 23:52:19 2017

Roll SwiftShader 81aa97b..83a6bb9

https://swiftshader.googlesource.com/SwiftShader.git/+log/81aa97b..83a6bb9

BUG= 732691 
BUG= 732739 
BUG= 732690 

TEST=bots

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel,linux_chromium_cfi_rel_ng;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Change-Id: Ia846062e48673f40879b60c87a8e2b5b12256036
Review-Url: https://codereview.chromium.org/2964913004
Cr-Commit-Position: refs/heads/master@{#484372}

[modify] https://crrev.com/e9be2af23b67c48d8e92201b8eee0e47ea725a6e/DEPS

Project Member

Comment 5 by ClusterFuzz, Jul 6 2017

ClusterFuzz has detected this issue as fixed in range 484343:484459.

Detailed report: https://clusterfuzz.com/testcase?key=4935196783935488

Fuzzer: libFuzzer_gpu_swiftshader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Indirect-leak
Crash Address: 
Crash State:
  Ice::VariableDeclaration* Ice::VariableDeclarationList::allocate_variable_declar
  Ice::VariableDeclaration::create
  sw::Nucleus::createConstantVector
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=478745:478819
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=484343:484459

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4935196783935488


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 6 by capn@chromium.org, Jul 6 2017

Status: Verified (was: Started)

Sign in to add a comment