Float-cast-overflow in gfx::ScaleToEnclosingRect |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4956073617522688 Fuzzer: miaubiz_svg_fuzzer Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: gfx::ScaleToEnclosingRect cc::LayerImpl::PopulateScaledSharedQuadState cc::PictureLayerImpl::AppendQuads Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=512234:512265 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4956073617522688 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Oct 30 2017
We get a 6.5501e+16 scale for solid color layer (from screen space transform skewY(90) skewX(76) scale(66) scale(21)). I think we should use ideal_contents_scale_ instead of GetIdealContentsScale() there since the former number has already got fixed in UpdateIdealContentsScale.
,
Oct 30 2017
That's reasonable. ideal_contents_scale_ also includes min and max contents scale, which is good. I forgot that GetIdealContentsScale comes from the base class.
,
Oct 31 2017
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
Oct 31 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/096f638e1345f3ca7239b0d5c0d3334bfc3fc5ad commit 096f638e1345f3ca7239b0d5c0d3334bfc3fc5ad Author: sunxd <sunxd@chromium.org> Date: Tue Oct 31 17:19:43 2017 cc: Use ideal_contents_scale_ in AppendQuads to prevent overflow In extreme cases, PictureLayerImpl::GetIdealContentsScale may return big float numbers that result in overflow of scaled rect when AppendQuads. We should use ideal_contents_scale_ which ceils the ideal contents scale with maximum allowed scale. Bug: 779334 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: Iac6cca7e20749575fa435e3a3ab38fa29ed847f6 Reviewed-on: https://chromium-review.googlesource.com/744402 Commit-Queue: Xianda Sun <sunxd@chromium.org> Reviewed-by: enne <enne@chromium.org> Cr-Commit-Position: refs/heads/master@{#512859} [modify] https://crrev.com/096f638e1345f3ca7239b0d5c0d3334bfc3fc5ad/cc/layers/picture_layer_impl.cc
,
Nov 1 2017
ClusterFuzz has detected this issue as fixed in range 512823:512886. Detailed report: https://clusterfuzz.com/testcase?key=4956073617522688 Fuzzer: miaubiz_svg_fuzzer Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: gfx::ScaleToEnclosingRect cc::LayerImpl::PopulateScaledSharedQuadState cc::PictureLayerImpl::AppendQuads Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=512234:512265 Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=512823:512886 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4956073617522688 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 1 2017
ClusterFuzz testcase 4956073617522688 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Nov 7 2017
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by pnangunoori@chromium.org
, Oct 30 2017Labels: M-64 Test-Predator-Wrong
Owner: sunxd@chromium.org
Status: Assigned (was: Untriaged)