New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 752749 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Aug 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: false in gles2_cmd_utils.cc

Project Member Reported by ClusterFuzz, Aug 5 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5533595694530560

Fuzzer: libFuzzer_gpu_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false in gles2_cmd_utils.cc
  base::debug::DebugBreak
  gpu::gles2::GLES2Util::GLFaceTargetToTextureTarget
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=469306:469316

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5533595694530560


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Labels: M-62 Test-Predator-Wrong
Owner: geoffl...@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "gles2_cmd_utils.cc", assigning to concern owner.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/c33c55f54595994b466290963fd8d292e185d0a5

@geofflang -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by piman@chromium.org, Aug 15 2017

Cc: zmo@chromium.org geoffl...@chromium.org
Components: Internals>GPU>Internals
Owner: piman@chromium.org
Proper stack.

#0 0x7f7c8b779c36 in gsignal /build/eglibc-SvCtMH/eglibc-2.19/signal/../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x7f7c8b77d027 in abort /build/eglibc-SvCtMH/eglibc-2.19/stdlib/abort.c:89
#2 0x7f7c94eda546 in base::debug::(anonymous namespace)::DebugBreak() base/debug/debugger_posix.cc:228:5
#3 0x7f7c94eda510 in base::debug::BreakDebugger() base/debug/debugger_posix.cc:258:3
#4 0x7f7c9509fcb4 in logging::LogMessage::~LogMessage() base/logging.cc:784:7
#5 0x7f7c97ab652c in gpu::gles2::GLES2Util::GLFaceTargetToTextureTarget(unsigned int) gpu/command_buffer/common/gles2_cmd_utils.cc:1062:7
#6 0x7f7c96220b55 in gpu::gles2::GLES2DecoderImpl::ValidateCopyTextureCHROMIUMTextures(char const*, unsigned int, gpu::gles2::TextureRef*, gpu::gles2::TextureRef*) gpu/command_buffer/service/gles2_cmd_decoder.cc:16617:7
#7 0x7f7c962281fb in gpu::gles2::GLES2DecoderImpl::DoCopySubTextureCHROMIUM(unsigned int, int, unsigned int, unsigned int, int, int, int, int, int, int, int, unsigned char, unsigned char, unsigned char) gpu/command_buffer/service/gles2_cmd_decoder.cc:17125:8
#8 0x7f7c96119e7e in gpu::gles2::GLES2DecoderImpl::HandleCopySubTextureCHROMIUM(unsigned int, void const volatile*) gpu/command_buffer/service/gles2_cmd_decoder_autogen.h:4622:3
#9 0x7f7c962578ba in gpu::error::Error gpu::gles2::GLES2DecoderImpl::DoCommandsImpl<false>(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/gles2_cmd_decoder.cc:5310:18
#10 0x7f7c9618a005 in gpu::gles2::GLES2DecoderImpl::DoCommands(unsigned int, void const volatile*, int, int*) gpu/command_buffer/service/gles2_cmd_decoder.cc:5361:12
#11 0x7f7c95f5a9e9 in gpu::CommandBufferService::Flush(int, gpu::AsyncAPIInterface*) gpu/command_buffer/service/command_buffer_service.cc:90:18
#12 0x7f7c95f550fb in gpu::CommandBufferDirect::Flush(int) gpu/command_buffer/service/command_buffer_direct.cc:99:12
#13 0x4f2b1f in gpu::(anonymous namespace)::CommandBufferSetup::RunCommandBuffer(unsigned char const*, unsigned long) gpu/command_buffer/tests/fuzzer_main.cc:229:22

Unlikely to be related to above. Will take a look.

Comment 3 by piman@chromium.org, Aug 15 2017

Simply missing enum validation. Patch incoming.
Project Member

Comment 4 by bugdroid1@chromium.org, Aug 16 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3bcef141a4a06567f046bc75a12a14a510696660

commit 3bcef141a4a06567f046bc75a12a14a510696660
Author: Antoine Labour <piman@chromium.org>
Date: Wed Aug 16 01:24:10 2017

Validate enums in BindTexImage2DWithInternalformatCHROMIUM and Copy{,Sub}TextureCHROMIUM

Bug:  752749 
Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
Change-Id: I6a0f4120cfaaa78e095ac61415e44401da6bdc90
Reviewed-on: https://chromium-review.googlesource.com/616260
Reviewed-by: Zhenyao Mo <zmo@chromium.org>
Commit-Queue: Antoine Labour <piman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#494654}
[modify] https://crrev.com/3bcef141a4a06567f046bc75a12a14a510696660/gpu/command_buffer/client/gles2_implementation_impl_autogen.h
[modify] https://crrev.com/3bcef141a4a06567f046bc75a12a14a510696660/gpu/command_buffer/client/gles2_implementation_unittest_autogen.h
[modify] https://crrev.com/3bcef141a4a06567f046bc75a12a14a510696660/gpu/command_buffer/cmd_buffer_functions.txt
[modify] https://crrev.com/3bcef141a4a06567f046bc75a12a14a510696660/gpu/command_buffer/service/gles2_cmd_decoder_autogen.h
[modify] https://crrev.com/3bcef141a4a06567f046bc75a12a14a510696660/gpu/command_buffer/service/gles2_cmd_decoder_unittest_textures.cc

Project Member

Comment 5 by ClusterFuzz, Aug 16 2017

ClusterFuzz has detected this issue as fixed in range 494649:494687.

Detailed report: https://clusterfuzz.com/testcase?key=5533595694530560

Fuzzer: libFuzzer_gpu_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false in gles2_cmd_utils.cc
  base::debug::DebugBreak
  gpu::gles2::GLES2Util::GLFaceTargetToTextureTarget
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=469306:469316
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=494649:494687

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5533595694530560

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Aug 16 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5533595694530560 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment