New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 754502 link

Starred by 1 user
Status: Fixed
Owner:
ksakamoto@chromium.org
Closed: Oct 2017
Cc:
█ msrchandra@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Timeout in ots_fuzzer

Project Member Reported by ClusterFuzz, Aug 10 2017 
Detailed report: https://clusterfuzz.com/testcase?key=5114809271189504

Fuzzer: libFuzzer_ots_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  ots_fuzzer
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5114809271189504

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. If the fix resolved the issue, please close the bug by marking as Fixed.

Comment 1 by msrchandra@chromium.org, Aug 11 2017

Cc: msrchandra@chromium.org
Labels: Test-Predator-Correct-CLs
Owner: ksakamoto@chromium.org
Status: Assigned (was: Untriaged)
Assigning to concern owner from Predator results --
Regression information is not available. The result is the blame information. 

Author: ksakamoto
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/de6e9bc76831e3eb79d30b76a4be76c610cc20f6
Time: Wed Jul 29 02:34:14 2015
The CL last changed line 352 of file gpos.cc, which is stack frame 3. 

Author: ksakamoto
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/de6e9bc76831e3eb79d30b76a4be76c610cc20f6
Time: Wed Jul 29 02:34:14 2015
The CL last changed line 401 of file gpos.cc, which is stack frame 4. 

Author: ksakamoto
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/de6e9bc76831e3eb79d30b76a4be76c610cc20f6
Time: Wed Jul 29 02:34:14 2015
The CL last changed line 1195 of file layout.cc, which is stack frame 5. 

Author: ksakamoto
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/de6e9bc76831e3eb79d30b76a4be76c610cc20f6
Time: Wed Jul 29 02:34:14 2015
The CL last changed line 259 of file layout.cc, which is stack frame 6. 

Author: ksakamoto
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/de6e9bc76831e3eb79d30b76a4be76c610cc20f6
Time: Wed Jul 29 02:34:14 2015
The CL last changed line 1344 of file layout.cc, which is stack frame 7. 

Author: ksakamoto
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/de6e9bc76831e3eb79d30b76a4be76c610cc20f6
Time: Wed Jul 29 02:34:14 2015
The CL last changed line 757 of file gpos.cc, which is stack frame 8. 

Author: ksakamoto
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/de6e9bc76831e3eb79d30b76a4be76c610cc20f6
Time: Wed Jul 29 02:34:14 2015
The CL last changed line 668 of file ots.cc, which is stack frame 9.

@ksakamoto -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by ksakamoto@chromium.org, Aug 14 2017 

Trying to reproduce locally but no luck so far.

Comment 3 by ksakamoto@chromium.org, Aug 15 2017

Components: Blink>WebFonts
OTS upstream has a commit with a link to (another) ots-fuzzer timeout issue.
https://github.com/khaledhosny/ots/commit/15ab3f7e0240ac9a0c07b087bf6d6e92565d9676

Let's roll new OTS version and see if it helps.
Project Member

Comment 4 by ClusterFuzz, Aug 16 2017

Labels: OS-Mac
Project Member

Comment 5 by bugdroid1@chromium.org, Oct 20 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/890796555b59082bd2b1f6baab916c50a418eb99

commit 890796555b59082bd2b1f6baab916c50a418eb99
Author: Kunihiko Sakamoto <ksakamoto@chromium.org>
Date: Fri Oct 20 07:41:00 2017

Update OTS to 010db68e (version 5.2.0)

This updates OTS from 8d70cffe (Version 5.0.1) to 010db68e (Version
5.2.0).

Notable changes:

- Use the new woff2 API that does not trust header totalSfntSize and
  glyf origLength.
- Fixed increased memory usage with some broken fonts as found by
  oss-fuzz.
- More tables can be passed through now.

Bug:  754502 
Change-Id: I1118767255f4dc7f34e5a2dd318a171db29034fb
Reviewed-on: https://chromium-review.googlesource.com/612976
Reviewed-by: Kenichi Ishibashi <bashi@chromium.org>
Commit-Queue: Kunihiko Sakamoto <ksakamoto@chromium.org>
Cr-Commit-Position: refs/heads/master@{#510369}
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/INSTALL
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/LICENSE
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/Makefile.am
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/README
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/README.chromium
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/configure.ac
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/include/opentype-sanitiser.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/include/ots-memory-stream.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/cff.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/cff.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/cff_type2_charstring.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/cff_type2_charstring.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/cmap.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/cmap.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/cvt.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/cvt.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/fpgm.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/fpgm.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/gasp.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/gasp.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/gdef.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/gdef.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/glyf.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/glyf.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/gpos.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/gpos.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/gsub.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/gsub.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/hdmx.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/hdmx.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/head.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/head.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/hhea.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/hhea.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/hmtx.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/hmtx.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/kern.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/kern.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/layout.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/layout.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/loca.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/loca.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/ltsh.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/ltsh.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/math.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/math_.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/maxp.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/maxp.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/metrics.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/metrics.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/name.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/name.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/os2.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/os2.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/ots.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/ots.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/post.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/post.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/prep.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/prep.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/vdmx.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/vdmx.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/vhea.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/vhea.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/vmtx.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/vmtx.h
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/vorg.cc
[modify] https://crrev.com/890796555b59082bd2b1f6baab916c50a418eb99/third_party/ots/src/vorg.h

Comment 6 by ksakamoto@chromium.org, Oct 24 2017

Status: Fixed (was: Assigned)
Looks like it's fixed.
►

Sign in to add a comment