New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 779334 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Float-cast-overflow in gfx::ScaleToEnclosingRect

Project Member Reported by ClusterFuzz, Oct 28 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4956073617522688

Fuzzer: miaubiz_svg_fuzzer
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  gfx::ScaleToEnclosingRect
  cc::LayerImpl::PopulateScaledSharedQuadState
  cc::PictureLayerImpl::AppendQuads
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=512234:512265

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4956073617522688

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: msrchandra@chromium.org pnangunoori@chromium.org
Labels: M-64 Test-Predator-Wrong
Owner: sunxd@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using the code search for the file, “picture_layer_impl.cc” assigning to concern owner from GIT blame.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/48493dc45de06867eec97e7944f56d511e3c4578

@sunxd -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.
Thank You.

Comment 2 by sunxd@chromium.org, Oct 30 2017

Cc: enne@chromium.org
We get a 6.5501e+16 scale for solid color layer (from screen space transform skewY(90) skewX(76) scale(66) scale(21)). I think we should use ideal_contents_scale_ instead of GetIdealContentsScale() there since the former number has already got fixed in UpdateIdealContentsScale.

Comment 3 by enne@chromium.org, Oct 30 2017

That's reasonable.  ideal_contents_scale_ also includes min and max contents scale, which is good.  I forgot that GetIdealContentsScale comes from the base class.
Project Member

Comment 4 by ClusterFuzz, Oct 31 2017

Components: Internals>Compositing UI>GFX
Labels: Test-Predator-AutoComponents
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 5 by bugdroid1@chromium.org, Oct 31 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/096f638e1345f3ca7239b0d5c0d3334bfc3fc5ad

commit 096f638e1345f3ca7239b0d5c0d3334bfc3fc5ad
Author: sunxd <sunxd@chromium.org>
Date: Tue Oct 31 17:19:43 2017

cc: Use ideal_contents_scale_ in AppendQuads to prevent overflow

In extreme cases, PictureLayerImpl::GetIdealContentsScale may return big
float numbers that result in overflow of scaled rect when AppendQuads.

We should use ideal_contents_scale_ which ceils the ideal contents scale
with maximum allowed scale.

Bug:  779334 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Iac6cca7e20749575fa435e3a3ab38fa29ed847f6
Reviewed-on: https://chromium-review.googlesource.com/744402
Commit-Queue: Xianda Sun <sunxd@chromium.org>
Reviewed-by: enne <enne@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512859}
[modify] https://crrev.com/096f638e1345f3ca7239b0d5c0d3334bfc3fc5ad/cc/layers/picture_layer_impl.cc

Project Member

Comment 6 by ClusterFuzz, Nov 1 2017

ClusterFuzz has detected this issue as fixed in range 512823:512886.

Detailed report: https://clusterfuzz.com/testcase?key=4956073617522688

Fuzzer: miaubiz_svg_fuzzer
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  gfx::ScaleToEnclosingRect
  cc::LayerImpl::PopulateScaledSharedQuadState
  cc::PictureLayerImpl::AppendQuads
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=512234:512265
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=512823:512886

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4956073617522688

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Nov 1 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4956073617522688 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components

Sign in to add a comment