New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 763435 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug



Sign in to add a comment

Divide-by-zero in sw::Renderer::executeTask

Project Member Reported by ClusterFuzz, Sep 8 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6103004909666304

Fuzzer: inferno_twister_c
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: Divide-by-zero
Crash Address: 0x8e335080
Crash State:
  sw::Renderer::executeTask
  sw::Renderer::taskLoop
  sw::Renderer::threadLoop
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=500358:500415

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6103004909666304

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: msrchandra@chromium.org
Components: Internals>GPU>SwiftShader
Labels: Test-Predator-Wrong-CLs M-63
Labels: CF-NeedsTriage

Comment 3 by ericrk@chromium.org, Sep 15 2017

Cc: kbr@chromium.org zmo@chromium.org sugoi@chromium.org
Status: Available (was: Untriaged)
Seems related to  bug 763655 . Enabling WebGL2 for swiftshader (here: https://chromium-review.googlesource.com/653499) likely exposed new swiftshader and ES3 issues to clusterfuzz.

kbr/zmo, can you take a look or reassign?

Comment 4 by sugoi@chromium.org, Sep 15 2017

Cc: -sugoi@chromium.org capn@chromium.org
Owner: sugoi@chromium.org
I'll take it.
Project Member

Comment 5 by bugdroid1@chromium.org, Oct 2 2017

The following revision refers to this bug:
  https://swiftshader.googlesource.com/SwiftShader.git/+/2895810bb5fc129ff03b7046563cbaf69108d216

commit 2895810bb5fc129ff03b7046563cbaf69108d216
Author: Alexis Hetu <sugoi@google.com>
Date: Mon Oct 02 19:10:05 2017

Fix for integer modulo operations

Integer division already had this modification, to avoid
division by 0, but integer modulo hadn't been modified
to match the other fix, which is now done here.

 Bug chromium:763435 

Change-Id: I40f4ed9f1c4b5889ddf47abc1bb7c70c21cbd7b8
Reviewed-on: https://swiftshader-review.googlesource.com/12908
Reviewed-by: Nicolas Capens <nicolascapens@google.com>
Tested-by: Alexis Hétu <sugoi@google.com>

[modify] https://crrev.com/2895810bb5fc129ff03b7046563cbaf69108d216/src/Shader/ShaderCore.cpp

Project Member

Comment 6 by bugdroid1@chromium.org, Oct 4 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5955bc576d147925fb8966ca7b91a23f7c91591e

commit 5955bc576d147925fb8966ca7b91a23f7c91591e
Author: Alexis Hetu <sugoi@google.com>
Date: Wed Oct 04 01:03:13 2017

Roll SwiftShader bc6ce4f..9d56da2

https://swiftshader.googlesource.com/SwiftShader.git/+log/bc6ce4f..9d56da2

BUG= chromium:763382 , chromium:763384 , chromium:763435 , chromium:765094 , chromium:765791 , chromium:765939 

TBR=kbr@chromium.org

TEST=bots

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel,linux_chromium_cfi_rel_ng;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Change-Id: Idd52bdc26eba54615838baf5dc65705a8a4be631
Reviewed-on: https://chromium-review.googlesource.com/699156
Commit-Queue: Alexis Hétu <sugoi@chromium.org>
Reviewed-by: Alexis Hétu <sugoi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#506259}
[modify] https://crrev.com/5955bc576d147925fb8966ca7b91a23f7c91591e/DEPS

Project Member

Comment 7 by ClusterFuzz, Oct 4 2017

ClusterFuzz has detected this issue as fixed in range 506249:506277.

Detailed report: https://clusterfuzz.com/testcase?key=6103004909666304

Fuzzer: inferno_twister_c
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: Divide-by-zero
Crash Address: 0xac6ca080
Crash State:
  sw::Renderer::executeTask
  sw::Renderer::taskLoop
  sw::Renderer::threadLoop
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=500358:500415
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=506249:506277

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6103004909666304

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Oct 4 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 6103004909666304 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment