CHECK failure: glGetError() == GL_NO_ERROR in gles2_cmd_decoder.cc |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5114718862966784 Fuzzer: libFuzzer_gpu_angle_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: glGetError() == GL_NO_ERROR in gles2_cmd_decoder.cc gpu::gles2::GLES2DecoderImpl::ClearLevel gpu::gles2::Texture::ClearLevel Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=514242:514268 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5114718862966784 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Nov 9 2017
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/5e48f901879796bf05fe124fdf82b45fe1d47bf2 (Reset unpack state before clearing textures with TexSubImage2D). If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
,
Nov 9 2017
The DCHECK catches a leftover GL error from a previous point. The stack that generates the error is:
#0 (anonymous namespace)::Context::handleError (this=0x36298a830020, error=...) at ../../third_party/angle/src/libANGLE/Context.cpp:2149
#1 0x00007ffff0ad072b in (anonymous namespace)::ValidateTexParameterBase<float> (context=0x36298a830020, target=3553, pname=33084, bufSize=-1, params=0x7fffffffca4c)
at ../../third_party/angle/src/libANGLE/validationES.cpp:5498
#2 0x00007ffff0af0b0f in (anonymous namespace)::ValidateTexParameterf (context=0x36298a830020, target=3553, pname=33084, param=-7.30157126e-07) at ../../third_party/angle/src/libANGLE/validationES2.cpp:6273
#3 0x00007ffff0819269 in (anonymous namespace)::TexParameterf (target=3553, pname=33084, param=-7.30157126e-07) at ../../third_party/angle/src/libGLESv2/entry_points_gles_2_0_autogen.cpp:1977
#4 0x00007ffff0836d53 in glTexParameterf (target=3553, pname=33084, param=-7.30157126e-07) at ../../third_party/angle/src/libGLESv2/libGLESv2.cpp:640
#5 0x00007ffff6de25cd in (anonymous namespace)::GLApiBase::glTexParameterfFn (this=0x36298a76b020, target=3553, pname=33084, param=-7.30157126e-07) at ../../ui/gl/gl_bindings_autogen_gl.cc:4422
#6 0x00007ffff783374f in (anonymous namespace)::(anonymous namespace)::TextureManager::SetParameterf (this=0x36298a899180, function_name=0x7ffff73f99eb "glTexParameterfv", error_state=0x36298a7f2d40,
ref=0x36298a87c180, pname=33084, param=-7.30157126e-07) at ../../gpu/command_buffer/service/texture_manager.cc:2272
#7 0x00007ffff76796c2 in (anonymous namespace)::(anonymous namespace)::GLES2DecoderImpl::DoTexParameterfv (this=0x36298a894020, target=3553, pname=33084, params=0x36298a89e0a4)
at ../../gpu/command_buffer/service/gles2_cmd_decoder.cc:9171
#8 0x00007ffff76329ca in (anonymous namespace)::(anonymous namespace)::GLES2DecoderImpl::HandleTexParameterfvImmediate (this=0x36298a894020, immediate_data_size=4, cmd_data=0x36298a89e098)
at ../../gpu/command_buffer/service/gles2_cmd_decoder_autogen.h:2896
#9 0x00007ffff76ab018 in (anonymous namespace)::(anonymous namespace)::GLES2DecoderImpl::DoCommandsImpl<false> (this=0x36298a894020, num_commands=20, buffer=0x36298a89e060, num_entries=117,
entries_processed=0x7fffffffd2fc) at ../../gpu/command_buffer/service/gles2_cmd_decoder.cc:5443
#10 0x00007ffff7666895 in (anonymous namespace)::(anonymous namespace)::GLES2DecoderImpl::DoCommands (this=0x36298a894020, num_commands=20, buffer=0x36298a89e060, num_entries=117,
entries_processed=0x7fffffffd2fc) at ../../gpu/command_buffer/service/gles2_cmd_decoder.cc:5494
#11 0x00007ffff75b827d in (anonymous namespace)::CommandBufferService::Flush (this=0x36298a7b5e48, put_offset=133, handler=0x36298a894020) at ../../gpu/command_buffer/service/command_buffer_service.cc:90
#12 0x00007ffff75b6b33 in (anonymous namespace)::CommandBufferDirect::Flush (this=0x36298a7b5e30, put_offset=133) at ../../gpu/command_buffer/service/command_buffer_direct.cc:99
#13 0x0000000000218e25 in (anonymous namespace)::(anonymous namespace)::CommandBufferSetup::RunCommandBuffer (this=0x36298a761a20, data=0x36298a76e6c0 "\003", size=529)
at ../../gpu/command_buffer/tests/fuzzer_main.cc:399
this is glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_BASE_LEVEL, param), where param is -7.30157126e-07, which is negative, but rounds to 0.
The decoder first converts to int (by rounding), then validates that it is non-negative.
ANGLE validates that it is non-negative before rounding.
According to the spec (2.3.1 Data Conversion For State-Setting Commands), the decoder does the right thing, so ANGLE should first convert (round) then validate:
"Validation of values performed by state-setting commands is performed after conversion, unless specified otherwise for a specific command."
,
Nov 9 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/b336d705f4e01900f5a18357c8a5cbde9e56669d commit b336d705f4e01900f5a18357c8a5cbde9e56669d Author: Antoine Labour <piman@chromium.org> Date: Thu Nov 09 22:41:20 2017 gpu_angle_fuzzer: catch GL errors Use GL_KHR_debug to allow the fuzzer to more accurately pinpoint GL errors. Bug: 783054 Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel Change-Id: I3dd4482c383c613ca111b77317a63770c59e13fe Reviewed-on: https://chromium-review.googlesource.com/761598 Commit-Queue: Antoine Labour <piman@chromium.org> Reviewed-by: Geoff Lang <geofflang@chromium.org> Cr-Commit-Position: refs/heads/master@{#515326} [modify] https://crrev.com/b336d705f4e01900f5a18357c8a5cbde9e56669d/gpu/command_buffer/tests/fuzzer_main.cc
,
Nov 10 2017
The following revision refers to this bug: https://chromium.googlesource.com/angle/angle/+/ee6884e7be666efc9e06b77eab7f4ead2779f46b commit ee6884e7be666efc9e06b77eab7f4ead2779f46b Author: Geoff Lang <geofflang@chromium.org> Date: Fri Nov 10 00:03:58 2017 Generate generic error messages for Error objects without messages. Makes sure that the debug output is fired for all generated errors. BUG= 783054 Change-Id: Ia30870cd950c53da892554e0862276d4be5360ac Reviewed-on: https://chromium-review.googlesource.com/761760 Commit-Queue: Geoff Lang <geofflang@chromium.org> Reviewed-by: Antoine Labour <piman@chromium.org> [modify] https://crrev.com/ee6884e7be666efc9e06b77eab7f4ead2779f46b/src/libANGLE/Error.cpp [modify] https://crrev.com/ee6884e7be666efc9e06b77eab7f4ead2779f46b/src/libANGLE/Context.cpp [modify] https://crrev.com/ee6884e7be666efc9e06b77eab7f4ead2779f46b/src/common/utilities.h [modify] https://crrev.com/ee6884e7be666efc9e06b77eab7f4ead2779f46b/src/common/utilities.cpp
,
Nov 10 2017
The following revision refers to this bug: https://skia.googlesource.com/skia/+/832536627766185a3fa3baf2bbf145a545d001a1 commit 832536627766185a3fa3baf2bbf145a545d001a1 Author: angle-deps-roller@chromium.org <angle-deps-roller@chromium.org> Date: Fri Nov 10 01:31:16 2017 Roll skia/third_party/externals/angle2/ 9e888a46f..ee6884e7b (1 commit) https://chromium.googlesource.com/angle/angle.git/+log/9e888a46f04d..ee6884e7be66 $ git log 9e888a46f..ee6884e7b --date=short --no-merges --format='%ad %ae %s' 2017-11-09 geofflang Generate generic error messages for Error objects without messages. Created with: roll-dep skia/third_party/externals/angle2 BUG= 783054 The AutoRoll server is located here: https://angle-skia-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=skia.primary:Perf-Win10-Clang-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-All-ANGLE,Perf-Win10-MSVC-Golo-GPU-QuadroP400-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUC5i7RYH-GPU-IntelIris6100-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-All-ANGLE,Perf-Win10-Clang-ShuttleC-GPU-GTX960-x86_64-Debug-All-ANGLE,Test-Win10-Clang-AlphaR2-GPU-RadeonR9M470X-x86_64-Debug-All-ANGLE,Test-Win10-MSVC-Golo-GPU-QuadroP400-x86_64-Debug-All-ANGLE,Test-Win10-Clang-NUC5i7RYH-GPU-IntelIris6100-x86_64-Debug-All-ANGLE,Test-Win10-Clang-NUC6i5SYK-GPU-IntelIris540-x86_64-Debug-All-ANGLE,Test-Win10-Clang-NUCD34010WYKH-GPU-IntelHD4400-x86_64-Debug-All-ANGLE,Test-Win10-Clang-ShuttleC-GPU-GTX960-x86_64-Debug-All-ANGLE,Build-Debian9-GCC-x86_64-Release-ANGLE TBR=egdaniel@google.com Change-Id: Icb2dd0abc0d555f97d0c2fdfc42e22f68673ad1d Reviewed-on: https://skia-review.googlesource.com/69541 Commit-Queue: angle-deps-roller . <angle-deps-roller@chromium.org> Reviewed-by: angle-deps-roller . <angle-deps-roller@chromium.org> [modify] https://crrev.com/832536627766185a3fa3baf2bbf145a545d001a1/DEPS
,
Nov 10 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/63dda46eede0ce964c89481c7a4a2d3e61472077 commit 63dda46eede0ce964c89481c7a4a2d3e61472077 Author: angle-deps-roller@chromium.org <angle-deps-roller@chromium.org> Date: Fri Nov 10 03:51:22 2017 Roll src/third_party/angle/ 9e888a46f..ee6884e7b (1 commit) https://chromium.googlesource.com/angle/angle.git/+log/9e888a46f04d..ee6884e7be66 $ git log 9e888a46f..ee6884e7b --date=short --no-merges --format='%ad %ae %s' 2017-11-09 geofflang Generate generic error messages for Error objects without messages. Created with: roll-dep src/third_party/angle BUG= 783054 The AutoRoll server is located here: https://angle-chromium-roll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel TBR=geofflang@chromium.org Change-Id: I73a79aab393f4a52c030dde8fb945571e3758f47 Reviewed-on: https://chromium-review.googlesource.com/762519 Reviewed-by: angle-deps-roller . <angle-deps-roller@chromium.org> Commit-Queue: angle-deps-roller . <angle-deps-roller@chromium.org> Cr-Commit-Position: refs/heads/master@{#515447} [modify] https://crrev.com/63dda46eede0ce964c89481c7a4a2d3e61472077/DEPS
,
Nov 10 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/6a5b6e735a92c00819115e4ec8dcf5907c7a7c34 commit 6a5b6e735a92c00819115e4ec8dcf5907c7a7c34 Author: skia-deps-roller@chromium.org <skia-deps-roller@chromium.org> Date: Fri Nov 10 06:22:32 2017 Roll src/third_party/skia/ 22499b096..832536627 (2 commits) https://skia.googlesource.com/skia.git/+log/22499b0969ac..832536627766 $ git log 22499b096..832536627 --date=short --no-merges --format='%ad %ae %s' 2017-11-10 angle-deps-roller Roll skia/third_party/externals/angle2/ 9e888a46f..ee6884e7b (1 commit) 2017-11-10 egdaniel Revert "Dynamically load the vulkan library in our test tools" Created with: roll-dep src/third_party/skia BUG= 783054 The AutoRoll server is located here: https://autoroll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel TBR=egdaniel@chromium.org Change-Id: Ic8a46e40c2a38f4f05946ef67fc8dd53f0a08f33 Reviewed-on: https://chromium-review.googlesource.com/762124 Reviewed-by: Skia Deps Roller <skia-deps-roller@chromium.org> Commit-Queue: Skia Deps Roller <skia-deps-roller@chromium.org> Cr-Commit-Position: refs/heads/master@{#515474} [modify] https://crrev.com/6a5b6e735a92c00819115e4ec8dcf5907c7a7c34/DEPS
,
Nov 10 2017
ClusterFuzz has detected this issue as fixed in range 515308:515346. Detailed report: https://clusterfuzz.com/testcase?key=5114718862966784 Fuzzer: libFuzzer_gpu_angle_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: glGetError() == GL_NO_ERROR in gles2_cmd_decoder.cc gpu::gles2::GLES2DecoderImpl::ClearLevel gpu::gles2::Texture::ClearLevel Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=514242:514268 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=515308:515346 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5114718862966784 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 10 2017
ClusterFuzz testcase 5114718862966784 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Nov 9 2017Labels: Test-Predator-Auto-Components