New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 745242 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Email to this user bounced
Closed: Aug 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in sh::TSymbol::getName

Project Member Reported by ClusterFuzz, Jul 18 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6598955302649856

Fuzzer: libFuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  sh::TSymbol::getName
  sh::TParseContext::createPrototypeNodeFromFunction
  sh::TParseContext::parseFunctionDefinitionHeader
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=487082:487198

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6598955302649856


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org oetu...@nvidia.com
Components: Internals>GPU>ANGLE
Labels: Test-Predator-Wrong-CLs M-61
Owner: jmad...@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL did not provide any possible suspects.
Using Code Search for the file, "SymbolTable.h" assigning to the concern owner from GIT Blame.

Suspecting Commit#
https://chromium.googlesource.com/angle/angle.git/+/d7b1ab5893953b97fe5dc1b3087a9b4b50ec45ee

@jmadill -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Project Member

Comment 2 by ClusterFuzz, Jul 18 2017

Labels: OS-Mac
Cc: jmad...@chromium.org
Owner: oetu...@nvidia.com
Olli is fixing this.
Project Member

Comment 4 by bugdroid1@chromium.org, Aug 9 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/85d624a5101da5ed9b327dba5b8186ab25bcd9dc

commit 85d624a5101da5ed9b327dba5b8186ab25bcd9dc
Author: Olli Etuaho <oetuaho@nvidia.com>
Date: Wed Aug 09 15:00:58 2017

Fix null pointer dereference in redeclaration error message

When a function parameter name conflicts with another, the pointer
returned to ParseContext will be null.

BUG= chromium:745242 
TEST=angle_unittests

Change-Id: Ie53bb06b0c6660e382d85aeda41f3a1b7df5a917
Reviewed-on: https://chromium-review.googlesource.com/603368
Reviewed-by: Corentin Wallez <cwallez@chromium.org>

[modify] https://crrev.com/85d624a5101da5ed9b327dba5b8186ab25bcd9dc/src/compiler/translator/ParseContext.cpp
[modify] https://crrev.com/85d624a5101da5ed9b327dba5b8186ab25bcd9dc/src/tests/compiler_tests/ShaderValidation_test.cpp

Project Member

Comment 5 by bugdroid1@chromium.org, Aug 9 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7a4915a8d1358d2924db6c0b1884b24283cb9d5c

commit 7a4915a8d1358d2924db6c0b1884b24283cb9d5c
Author: Corentin Wallez <cwallez@chromium.org>
Date: Wed Aug 09 17:07:03 2017

Roll ANGLE 13c0dd4..85d624a

https://chromium.googlesource.com/angle/angle.git/+log/13c0dd4..85d624a

BUG= chromium:745242 

TBR=geofflang@chromium.org

TEST=bots

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Change-Id: I8929065a0bd9d609ecf2abfb76e8e03bb2d5cf90
Reviewed-on: https://chromium-review.googlesource.com/608608
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Cr-Commit-Position: refs/heads/master@{#493030}
[modify] https://crrev.com/7a4915a8d1358d2924db6c0b1884b24283cb9d5c/DEPS

Project Member

Comment 6 by bugdroid1@chromium.org, Aug 9 2017

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/5400c0b0e2cf8f2e4f09f7a8ff3d314b936b65e2

commit 5400c0b0e2cf8f2e4f09f7a8ff3d314b936b65e2
Author: skia-deps-roller@chromium.org <skia-deps-roller@chromium.org>
Date: Wed Aug 09 17:46:04 2017

Roll skia/third_party/externals/angle2/ 880683b17..85d624a51 (3 commits)

https://chromium.googlesource.com/angle/angle.git/+log/880683b17381..85d624a5101d

$ git log 880683b17..85d624a51 --date=short --no-merges --format='%ad %ae %s'

Created with:
  roll-dep skia/third_party/externals/angle2
BUG= 745242 


Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls


CQ_INCLUDE_TRYBOTS=skia.primary:Perf-Win10-MSVC-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-ANGLE,Perf-Win10-MSVC-NUC5i7RYH-GPU-IntelIris6100-x86_64-Debug-ANGLE,Perf-Win10-MSVC-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-ANGLE,Perf-Win10-MSVC-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-ANGLE,Perf-Win10-MSVC-ShuttleC-GPU-GTX960-x86_64-Debug-ANGLE,Perf-Win10-MSVC-ZBOX-GPU-GTX1070-x86_64-Debug-ANGLE,Test-Win10-MSVC-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-ANGLE,Test-Win10-MSVC-NUC5i7RYH-GPU-IntelIris6100-x86_64-Debug-ANGLE,Test-Win10-MSVC-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-ANGLE,Test-Win10-MSVC-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-ANGLE,Test-Win10-MSVC-ShuttleC-GPU-GTX960-x86_64-Debug-ANGLE,Test-Win10-MSVC-ZBOX-GPU-GTX1070-x86_64-Debug-ANGLE
TBR=bungeman@google.com

Change-Id: I2877eca8f889a8b2bb53aad3a6767632f1f14c15
Reviewed-on: https://skia-review.googlesource.com/32642
Commit-Queue: Skia Deps Roller <skia-deps-roller@chromium.org>
Reviewed-by: Skia Deps Roller <skia-deps-roller@chromium.org>

[modify] https://crrev.com/5400c0b0e2cf8f2e4f09f7a8ff3d314b936b65e2/DEPS

Project Member

Comment 7 by bugdroid1@chromium.org, Aug 10 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c81633b02745de3295e97836086dbb7bc3e2f22c

commit c81633b02745de3295e97836086dbb7bc3e2f22c
Author: skia-deps-roller@chromium.org <skia-deps-roller@chromium.org>
Date: Thu Aug 10 00:49:55 2017

Roll src/third_party/skia/ 69fd00819..5eb8fc585 (18 commits)

https://skia.googlesource.com/skia.git/+log/69fd00819998..5eb8fc585e9b

$ git log 69fd00819..5eb8fc585 --date=short --no-merges --format='%ad %ae %s'
2017-08-08 liyuqian No chop at y extrema for cubics
2017-08-09 brianosman Revert "GrContext::dump that produces JSON formatted output"
2017-08-09 brianosman Revert "Support single line objects and arrays"
2017-08-09 bsalomon Move GrProcessorSet into GrPipeline
2017-08-09 mtklein Remove SkColorLookUpTable::interp3D().
2017-08-09 robertphillips Revert "Store discard request on the opList and remove GrDiscardOp"
2017-08-09 liyuqian Move gFDot6INVERSE definition to cpp file
2017-08-09 brianosman Support single line objects and arrays
2017-08-09 brianosman GrContext::dump that produces JSON formatted output
2017-08-09 mtklein add gamma stage
2017-08-09 robertphillips Store discard request on the opList and remove GrDiscardOp
2017-08-09 reed use unsigned to avoid runtime overflow detection
2017-08-09 skia-deps-roller Roll skia/third_party/externals/angle2/ 880683b17..85d624a51 (3 commits)
2017-08-07 ericrk Improve float-based dither logic
2017-08-09 skia-deps-roller Roll skia/third_party/externals/angle2/ 3c76d59f1..880683b17 (2 commits)
2017-08-09 reed handle overflows in float->int
2017-08-09 robertphillips Fix stencil clear load in Vulkan
2017-08-09 robertphillips Store GrRenderTarget in GrGpuCommandBuffer

Created with:
  roll-dep src/third_party/skia
BUG= 745242 


Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls


CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel
TBR=bungeman@chromium.org

Change-Id: I5899000395db17cb3c92ad41ba1b79b2d4758c45
Reviewed-on: https://chromium-review.googlesource.com/609090
Reviewed-by: Skia Deps Roller <skia-deps-roller@chromium.org>
Commit-Queue: Skia Deps Roller <skia-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#493197}
[modify] https://crrev.com/c81633b02745de3295e97836086dbb7bc3e2f22c/DEPS

Project Member

Comment 8 by ClusterFuzz, Aug 10 2017

ClusterFuzz has detected this issue as fixed in range 492992:493042.

Detailed report: https://clusterfuzz.com/testcase?key=6598955302649856

Fuzzer: libFuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  sh::TSymbol::getName
  sh::TParseContext::createPrototypeNodeFromFunction
  sh::TParseContext::parseFunctionDefinitionHeader
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=487082:487198
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=492992:493042

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6598955302649856

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Aug 10 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6598955302649856 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment