New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 758159 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Aug 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux , All
Pri: 1
Type: Bug



Sign in to add a comment

ASSERT: false

Project Member Reported by ClusterFuzz, Aug 23 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5635868361752576

Fuzzer: libFuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  false
  sh::TParseContext::addIndexExpression
  yyparse
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=496390:496444

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5635868361752576

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org oetu...@nvidia.com
Labels: Test-Predator-Wrong-CLs M-62
Owner: jiawei.s...@intel.com
Predator and CL could not provide any possible suspects.
Using Code Search for file, "ParseContext.cpp" assigning to concern owner from GIT Blame.

Suspecting Commit#
https://chromium.googlesource.com/angle/angle.git/+/d8105a03fa17e37ef66ab1a2a0b094abbc924e75

@jiawei.shao -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Status: Assigned (was: Untriaged)
Hi all,
I am working on this issue:
https://chromium-review.googlesource.com/c/angle/angle/+/631797
Labels: -OS-Linux OS-All
Status: Started (was: Assigned)
Project Member

Comment 5 by ClusterFuzz, Aug 25 2017

Labels: OS-Linux
Project Member

Comment 6 by bugdroid1@chromium.org, Aug 28 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/7e1197e01aed3a23d47a29658d7f1a114e39d4f0

commit 7e1197e01aed3a23d47a29658d7f1a114e39d4f0
Author: Jiawei Shao <jiawei.shao@intel.com>
Date: Mon Aug 28 14:03:34 2017

Fix crash when indexing unsupported interface blocks by variable

This patch intends to fix a compiler crash when indexing an
unsupported interface blocks. We should not use UNREACHABLE() here
because the compiler will continue parsing when this kind of error
is generated. Instead, we use an ASSERT to ensure the compile error
must have been reported before when the parsing reaches here.

BUG= chromium:758159 

Change-Id: I4bc63316d156d51f721123fe963106d1e81d8d32
Reviewed-on: https://chromium-review.googlesource.com/631797
Reviewed-by: Olli Etuaho <oetuaho@nvidia.com>
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Commit-Queue: Jamie Madill <jmadill@chromium.org>

[modify] https://crrev.com/7e1197e01aed3a23d47a29658d7f1a114e39d4f0/src/compiler/translator/ParseContext.cpp
[modify] https://crrev.com/7e1197e01aed3a23d47a29658d7f1a114e39d4f0/src/tests/compiler_tests/ShaderValidation_test.cpp

Project Member

Comment 7 by bugdroid1@chromium.org, Aug 28 2017

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/e94871bf8308b72ed44353956f1ff6c4ba6e7597

commit e94871bf8308b72ed44353956f1ff6c4ba6e7597
Author: angle-deps-roller@chromium.org <angle-deps-roller@chromium.org>
Date: Mon Aug 28 15:16:37 2017

Roll skia/third_party/externals/angle2/ 97577623f..7e1197e01 (1 commit)

https://chromium.googlesource.com/angle/angle.git/+log/97577623f516..7e1197e01aed

$ git log 97577623f..7e1197e01 --date=short --no-merges --format='%ad %ae %s'

Created with:
  roll-dep skia/third_party/externals/angle2
BUG= 758159 


Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls


CQ_INCLUDE_TRYBOTS=skia.primary:Perf-Win10-MSVC-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-ANGLE,Perf-Win10-MSVC-NUC5i7RYH-GPU-IntelIris6100-x86_64-Debug-ANGLE,Perf-Win10-MSVC-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-ANGLE,Perf-Win10-MSVC-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-ANGLE,Perf-Win10-MSVC-ShuttleC-GPU-GTX960-x86_64-Debug-ANGLE,Perf-Win10-MSVC-ZBOX-GPU-GTX1070-x86_64-Debug-ANGLE,Test-Win10-MSVC-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-ANGLE,Test-Win10-MSVC-NUC5i7RYH-GPU-IntelIris6100-x86_64-Debug-ANGLE,Test-Win10-MSVC-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-ANGLE,Test-Win10-MSVC-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-ANGLE,Test-Win10-MSVC-ShuttleC-GPU-GTX960-x86_64-Debug-ANGLE,Test-Win10-MSVC-ZBOX-GPU-GTX1070-x86_64-Debug-ANGLE
TBR=djsollen@google.com

Change-Id: I3cfc84c90b3c5db189961901db3c5b4cb7c83b9b
Reviewed-on: https://skia-review.googlesource.com/39360
Reviewed-by: angle-deps-roller . <angle-deps-roller@chromium.org>
Commit-Queue: angle-deps-roller . <angle-deps-roller@chromium.org>

[modify] https://crrev.com/e94871bf8308b72ed44353956f1ff6c4ba6e7597/DEPS

Project Member

Comment 8 by bugdroid1@chromium.org, Aug 28 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f94808b9a57b684dfaae3872d5cf333a2deb50f3

commit f94808b9a57b684dfaae3872d5cf333a2deb50f3
Author: skia-deps-roller@chromium.org <skia-deps-roller@chromium.org>
Date: Mon Aug 28 16:50:02 2017

Roll src/third_party/skia/ 26acbe8a8..e94871bf8 (1 commit)

https://skia.googlesource.com/skia.git/+log/26acbe8a8925..e94871bf8308

$ git log 26acbe8a8..e94871bf8 --date=short --no-merges --format='%ad %ae %s'
2017-08-28 angle-deps-roller Roll skia/third_party/externals/angle2/ 97577623f..7e1197e01 (1 commit)

Created with:
  roll-dep src/third_party/skia
BUG= 758159 


Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, see:
http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls


CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel
TBR=djsollen@chromium.org

Change-Id: I121a2866ada680d7a5e40875c1fd997fcd0b4485
Reviewed-on: https://chromium-review.googlesource.com/638490
Reviewed-by: Skia Deps Roller <skia-deps-roller@chromium.org>
Commit-Queue: Skia Deps Roller <skia-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#497779}
[modify] https://crrev.com/f94808b9a57b684dfaae3872d5cf333a2deb50f3/DEPS

Project Member

Comment 9 by bugdroid1@chromium.org, Aug 28 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3b0be26c6b7b03cd1705606930ce3b471a5c5a7f

commit 3b0be26c6b7b03cd1705606930ce3b471a5c5a7f
Author: Jamie Madill <jmadill@chromium.org>
Date: Mon Aug 28 22:03:55 2017

Roll ANGLE ef66151..a42a4e5

https://chromium.googlesource.com/angle/angle.git/+log/ef66151..a42a4e5

BUG=chromium:752917, chromium:758159 

TBR=geofflang@chromium.org

TEST=bots

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Change-Id: I776c99c90cb259780d634cd0ea4e8290c4ff1b26
Reviewed-on: https://chromium-review.googlesource.com/639191
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Commit-Queue: Jamie Madill <jmadill@chromium.org>
Cr-Commit-Position: refs/heads/master@{#497892}
[modify] https://crrev.com/3b0be26c6b7b03cd1705606930ce3b471a5c5a7f/DEPS

Hi Msrchandra, 

I have verified this bug has been fixed with https://chromium-review.googlesource.com/631797. Could you have a double check on this issue? Thanks! 
Project Member

Comment 11 by ClusterFuzz, Aug 29 2017

ClusterFuzz has detected this issue as fixed in range 497860:497936.

Detailed report: https://clusterfuzz.com/testcase?key=5635868361752576

Fuzzer: libFuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  false
  sh::TParseContext::addIndexExpression
  yyparse
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=496390:496444
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=497860:497936

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5635868361752576

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by ClusterFuzz, Aug 29 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 5635868361752576 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment