CHECK failure: false in gles2_cmd_utils.cc |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5533595694530560 Fuzzer: libFuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: false in gles2_cmd_utils.cc base::debug::DebugBreak gpu::gles2::GLES2Util::GLFaceTargetToTextureTarget Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=469306:469316 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5533595694530560 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Aug 15 2017
Proper stack. #0 0x7f7c8b779c36 in gsignal /build/eglibc-SvCtMH/eglibc-2.19/signal/../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x7f7c8b77d027 in abort /build/eglibc-SvCtMH/eglibc-2.19/stdlib/abort.c:89 #2 0x7f7c94eda546 in base::debug::(anonymous namespace)::DebugBreak() base/debug/debugger_posix.cc:228:5 #3 0x7f7c94eda510 in base::debug::BreakDebugger() base/debug/debugger_posix.cc:258:3 #4 0x7f7c9509fcb4 in logging::LogMessage::~LogMessage() base/logging.cc:784:7 #5 0x7f7c97ab652c in gpu::gles2::GLES2Util::GLFaceTargetToTextureTarget(unsigned int) gpu/command_buffer/common/gles2_cmd_utils.cc:1062:7 #6 0x7f7c96220b55 in gpu::gles2::GLES2DecoderImpl::ValidateCopyTextureCHROMIUMTextures(char const*, unsigned int, gpu::gles2::TextureRef*, gpu::gles2::TextureRef*) gpu/command_buffer/service/gles2_cmd_decoder.cc:16617:7 #7 0x7f7c962281fb in gpu::gles2::GLES2DecoderImpl::DoCopySubTextureCHROMIUM(unsigned int, int, unsigned int, unsigned int, int, int, int, int, int, int, int, unsigned char, unsigned char, unsigned char) gpu/command_buffer/service/gles2_cmd_decoder.cc:17125:8 #8 0x7f7c96119e7e in gpu::gles2::GLES2DecoderImpl::HandleCopySubTextureCHROMIUM(unsigned int, void const volatile*) gpu/command_buffer/service/gles2_cmd_decoder_autogen.h:4622:3 #9 0x7f7c962578ba in gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false>(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/gles2_cmd_decoder.cc:5310:18 #10 0x7f7c9618a005 in gpu::gles2::GLES2DecoderImpl::DoCommands(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/gles2_cmd_decoder.cc:5361:12 #11 0x7f7c95f5a9e9 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:90:18 #12 0x7f7c95f550fb in gpu::CommandBufferDirect::Flush(int) gpu/command_buffer/service/command_buffer_direct.cc:99:12 #13 0x4f2b1f in gpu::(anonymous namespace)::CommandBufferSetup::RunCommandBuffer(unsigned char const*, unsigned long) gpu/command_buffer/tests/fuzzer_main.cc:229:22 Unlikely to be related to above. Will take a look.
,
Aug 15 2017
Simply missing enum validation. Patch incoming.
,
Aug 16 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/3bcef141a4a06567f046bc75a12a14a510696660 commit 3bcef141a4a06567f046bc75a12a14a510696660 Author: Antoine Labour <piman@chromium.org> Date: Wed Aug 16 01:24:10 2017 Validate enums in BindTexImage2DWithInternalformatCHROMIUM and Copy{,Sub}TextureCHROMIUM Bug: 752749 Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel Change-Id: I6a0f4120cfaaa78e095ac61415e44401da6bdc90 Reviewed-on: https://chromium-review.googlesource.com/616260 Reviewed-by: Zhenyao Mo <zmo@chromium.org> Commit-Queue: Antoine Labour <piman@chromium.org> Cr-Commit-Position: refs/heads/master@{#494654} [modify] https://crrev.com/3bcef141a4a06567f046bc75a12a14a510696660/gpu/command_buffer/client/gles2_implementation_impl_autogen.h [modify] https://crrev.com/3bcef141a4a06567f046bc75a12a14a510696660/gpu/command_buffer/client/gles2_implementation_unittest_autogen.h [modify] https://crrev.com/3bcef141a4a06567f046bc75a12a14a510696660/gpu/command_buffer/cmd_buffer_functions.txt [modify] https://crrev.com/3bcef141a4a06567f046bc75a12a14a510696660/gpu/command_buffer/service/gles2_cmd_decoder_autogen.h [modify] https://crrev.com/3bcef141a4a06567f046bc75a12a14a510696660/gpu/command_buffer/service/gles2_cmd_decoder_unittest_textures.cc
,
Aug 16 2017
ClusterFuzz has detected this issue as fixed in range 494649:494687. Detailed report: https://clusterfuzz.com/testcase?key=5533595694530560 Fuzzer: libFuzzer_gpu_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: false in gles2_cmd_utils.cc base::debug::DebugBreak gpu::gles2::GLES2Util::GLFaceTargetToTextureTarget Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=469306:469316 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=494649:494687 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5533595694530560 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 16 2017
ClusterFuzz testcase 5533595694530560 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by msrchandra@chromium.org
, Aug 7 2017Labels: M-62 Test-Predator-Wrong
Owner: geoffl...@chromium.org
Status: Assigned (was: Untriaged)