Null-dereference READ in sh::TSymbol::getName |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6598955302649856 Fuzzer: libFuzzer_angle_translator_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000010 Crash State: sh::TSymbol::getName sh::TParseContext::createPrototypeNodeFromFunction sh::TParseContext::parseFunctionDefinitionHeader Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=487082:487198 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6598955302649856 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jul 18 2017
,
Jul 21 2017
Olli is fixing this.
,
Aug 9 2017
The following revision refers to this bug: https://chromium.googlesource.com/angle/angle/+/85d624a5101da5ed9b327dba5b8186ab25bcd9dc commit 85d624a5101da5ed9b327dba5b8186ab25bcd9dc Author: Olli Etuaho <oetuaho@nvidia.com> Date: Wed Aug 09 15:00:58 2017 Fix null pointer dereference in redeclaration error message When a function parameter name conflicts with another, the pointer returned to ParseContext will be null. BUG= chromium:745242 TEST=angle_unittests Change-Id: Ie53bb06b0c6660e382d85aeda41f3a1b7df5a917 Reviewed-on: https://chromium-review.googlesource.com/603368 Reviewed-by: Corentin Wallez <cwallez@chromium.org> [modify] https://crrev.com/85d624a5101da5ed9b327dba5b8186ab25bcd9dc/src/compiler/translator/ParseContext.cpp [modify] https://crrev.com/85d624a5101da5ed9b327dba5b8186ab25bcd9dc/src/tests/compiler_tests/ShaderValidation_test.cpp
,
Aug 9 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/7a4915a8d1358d2924db6c0b1884b24283cb9d5c commit 7a4915a8d1358d2924db6c0b1884b24283cb9d5c Author: Corentin Wallez <cwallez@chromium.org> Date: Wed Aug 09 17:07:03 2017 Roll ANGLE 13c0dd4..85d624a https://chromium.googlesource.com/angle/angle.git/+log/13c0dd4..85d624a BUG= chromium:745242 TBR=geofflang@chromium.org TEST=bots CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel Change-Id: I8929065a0bd9d609ecf2abfb76e8e03bb2d5cf90 Reviewed-on: https://chromium-review.googlesource.com/608608 Reviewed-by: Corentin Wallez <cwallez@chromium.org> Commit-Queue: Corentin Wallez <cwallez@chromium.org> Cr-Commit-Position: refs/heads/master@{#493030} [modify] https://crrev.com/7a4915a8d1358d2924db6c0b1884b24283cb9d5c/DEPS
,
Aug 9 2017
The following revision refers to this bug: https://skia.googlesource.com/skia/+/5400c0b0e2cf8f2e4f09f7a8ff3d314b936b65e2 commit 5400c0b0e2cf8f2e4f09f7a8ff3d314b936b65e2 Author: skia-deps-roller@chromium.org <skia-deps-roller@chromium.org> Date: Wed Aug 09 17:46:04 2017 Roll skia/third_party/externals/angle2/ 880683b17..85d624a51 (3 commits) https://chromium.googlesource.com/angle/angle.git/+log/880683b17381..85d624a5101d $ git log 880683b17..85d624a51 --date=short --no-merges --format='%ad %ae %s' Created with: roll-dep skia/third_party/externals/angle2 BUG= 745242 Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, see: http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls CQ_INCLUDE_TRYBOTS=skia.primary:Perf-Win10-MSVC-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-ANGLE,Perf-Win10-MSVC-NUC5i7RYH-GPU-IntelIris6100-x86_64-Debug-ANGLE,Perf-Win10-MSVC-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-ANGLE,Perf-Win10-MSVC-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-ANGLE,Perf-Win10-MSVC-ShuttleC-GPU-GTX960-x86_64-Debug-ANGLE,Perf-Win10-MSVC-ZBOX-GPU-GTX1070-x86_64-Debug-ANGLE,Test-Win10-MSVC-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-ANGLE,Test-Win10-MSVC-NUC5i7RYH-GPU-IntelIris6100-x86_64-Debug-ANGLE,Test-Win10-MSVC-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-ANGLE,Test-Win10-MSVC-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-ANGLE,Test-Win10-MSVC-ShuttleC-GPU-GTX960-x86_64-Debug-ANGLE,Test-Win10-MSVC-ZBOX-GPU-GTX1070-x86_64-Debug-ANGLE TBR=bungeman@google.com Change-Id: I2877eca8f889a8b2bb53aad3a6767632f1f14c15 Reviewed-on: https://skia-review.googlesource.com/32642 Commit-Queue: Skia Deps Roller <skia-deps-roller@chromium.org> Reviewed-by: Skia Deps Roller <skia-deps-roller@chromium.org> [modify] https://crrev.com/5400c0b0e2cf8f2e4f09f7a8ff3d314b936b65e2/DEPS
,
Aug 10 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c81633b02745de3295e97836086dbb7bc3e2f22c commit c81633b02745de3295e97836086dbb7bc3e2f22c Author: skia-deps-roller@chromium.org <skia-deps-roller@chromium.org> Date: Thu Aug 10 00:49:55 2017 Roll src/third_party/skia/ 69fd00819..5eb8fc585 (18 commits) https://skia.googlesource.com/skia.git/+log/69fd00819998..5eb8fc585e9b $ git log 69fd00819..5eb8fc585 --date=short --no-merges --format='%ad %ae %s' 2017-08-08 liyuqian No chop at y extrema for cubics 2017-08-09 brianosman Revert "GrContext::dump that produces JSON formatted output" 2017-08-09 brianosman Revert "Support single line objects and arrays" 2017-08-09 bsalomon Move GrProcessorSet into GrPipeline 2017-08-09 mtklein Remove SkColorLookUpTable::interp3D(). 2017-08-09 robertphillips Revert "Store discard request on the opList and remove GrDiscardOp" 2017-08-09 liyuqian Move gFDot6INVERSE definition to cpp file 2017-08-09 brianosman Support single line objects and arrays 2017-08-09 brianosman GrContext::dump that produces JSON formatted output 2017-08-09 mtklein add gamma stage 2017-08-09 robertphillips Store discard request on the opList and remove GrDiscardOp 2017-08-09 reed use unsigned to avoid runtime overflow detection 2017-08-09 skia-deps-roller Roll skia/third_party/externals/angle2/ 880683b17..85d624a51 (3 commits) 2017-08-07 ericrk Improve float-based dither logic 2017-08-09 skia-deps-roller Roll skia/third_party/externals/angle2/ 3c76d59f1..880683b17 (2 commits) 2017-08-09 reed handle overflows in float->int 2017-08-09 robertphillips Fix stencil clear load in Vulkan 2017-08-09 robertphillips Store GrRenderTarget in GrGpuCommandBuffer Created with: roll-dep src/third_party/skia BUG= 745242 Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, see: http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel TBR=bungeman@chromium.org Change-Id: I5899000395db17cb3c92ad41ba1b79b2d4758c45 Reviewed-on: https://chromium-review.googlesource.com/609090 Reviewed-by: Skia Deps Roller <skia-deps-roller@chromium.org> Commit-Queue: Skia Deps Roller <skia-deps-roller@chromium.org> Cr-Commit-Position: refs/heads/master@{#493197} [modify] https://crrev.com/c81633b02745de3295e97836086dbb7bc3e2f22c/DEPS
,
Aug 10 2017
ClusterFuzz has detected this issue as fixed in range 492992:493042. Detailed report: https://clusterfuzz.com/testcase?key=6598955302649856 Fuzzer: libFuzzer_angle_translator_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000010 Crash State: sh::TSymbol::getName sh::TParseContext::createPrototypeNodeFromFunction sh::TParseContext::parseFunctionDefinitionHeader Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=487082:487198 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=492992:493042 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6598955302649856 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 10 2017
ClusterFuzz testcase 6598955302649856 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by msrchandra@chromium.org
, Jul 18 2017Components: Internals>GPU>ANGLE
Labels: Test-Predator-Wrong-CLs M-61
Owner: jmad...@chromium.org
Status: Assigned (was: Untriaged)