Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/angle/angle/+/ee6884e7be666efc9e06b77eab7f4ead2779f46b (Generate generic error messages for Error objects without messages.).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

Mo, could you look into this?

The bug is that GLES2DecoderImpl::DoCopyTexImage2D calls glTexImage2D in some cases (https://cs.chromium.org/chromium/src/gpu/command_buffer/service/gles2_cmd_decoder.cc?q=DoCopyTexImage2D&l=14825) but does not reset PBO bindings first.  There may be more cases of this issue.

Thanks for taking a look and sharing your initial analysis. I'll look into fixing this.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5f72df0c431a8037229ccb8433153c1e1a40d400

commit 5f72df0c431a8037229ccb8433153c1e1a40d400
Author: Zhenyao Mo <zmo@chromium.org>
Date: Fri Dec 08 21:46:26 2017

Set unpack binding/params before uploading textures internally in GPU command buffer.

BUG= 786358 
TEST=test in the bug, gpu_unittests
R=piman@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
Change-Id: Ifd7cb5f908e1a34fdb35c1c18b8747183c8bd980
Reviewed-on: https://chromium-review.googlesource.com/815385
Reviewed-by: Antoine Labour <piman@chromium.org>
Commit-Queue: Zhenyao Mo <zmo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#522889}
[modify] https://crrev.com/5f72df0c431a8037229ccb8433153c1e1a40d400/gpu/command_buffer/service/context_state.cc
[modify] https://crrev.com/5f72df0c431a8037229ccb8433153c1e1a40d400/gpu/command_buffer/service/context_state.h
[modify] https://crrev.com/5f72df0c431a8037229ccb8433153c1e1a40d400/gpu/command_buffer/service/gles2_cmd_decoder.cc
[modify] https://crrev.com/5f72df0c431a8037229ccb8433153c1e1a40d400/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.cc
[modify] https://crrev.com/5f72df0c431a8037229ccb8433153c1e1a40d400/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.h
[modify] https://crrev.com/5f72df0c431a8037229ccb8433153c1e1a40d400/gpu/command_buffer/service/gles2_cmd_decoder_unittest_drawing.cc
[modify] https://crrev.com/5f72df0c431a8037229ccb8433153c1e1a40d400/gpu/command_buffer/service/gles2_cmd_decoder_unittest_textures.cc

ClusterFuzz has detected this issue as fixed in range 522874:522901.

Detailed report: https://clusterfuzz.com/testcase?key=5223813381095424

Fuzzer: libFuzzer_gpu_angle_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x03e900002f71
Crash State:
  gpu::CommandBufferSetup::LogGLDebugMessage
  gl::Debug::insertMessage
  gl::Debug::insertMessage
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=515438:515451
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=522874:522901

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5223813381095424

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5223813381095424 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Your change meets the bar and is auto-approved for M64. Please go ahead and merge the CL to branch 3282 manually. Please contact milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), kbleicher@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/265bb5a1bb62a04cfaebe0cda3b08c08383e6b87

commit 265bb5a1bb62a04cfaebe0cda3b08c08383e6b87
Author: Zhenyao Mo <zmo@chromium.org>
Date: Mon Dec 11 23:14:18 2017

Set unpack binding/params before uploading textures internally in GPU command buffer.

BUG= 786358 
TEST=test in the bug, gpu_unittests
R=​piman@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
Change-Id: Ifd7cb5f908e1a34fdb35c1c18b8747183c8bd980
Reviewed-on: https://chromium-review.googlesource.com/815385
Reviewed-by: Antoine Labour <piman@chromium.org>
Commit-Queue: Zhenyao Mo <zmo@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#522889}(cherry picked from commit 5f72df0c431a8037229ccb8433153c1e1a40d400)
Reviewed-on: https://chromium-review.googlesource.com/820938
Reviewed-by: Zhenyao Mo <zmo@chromium.org>
Cr-Commit-Position: refs/branch-heads/3282@{#158}
Cr-Branched-From: 5fdc0fab22ce7efd32532ee989b223fa12f8171e-refs/heads/master@{#520840}
[modify] https://crrev.com/265bb5a1bb62a04cfaebe0cda3b08c08383e6b87/gpu/command_buffer/service/context_state.cc
[modify] https://crrev.com/265bb5a1bb62a04cfaebe0cda3b08c08383e6b87/gpu/command_buffer/service/context_state.h
[modify] https://crrev.com/265bb5a1bb62a04cfaebe0cda3b08c08383e6b87/gpu/command_buffer/service/gles2_cmd_decoder.cc
[modify] https://crrev.com/265bb5a1bb62a04cfaebe0cda3b08c08383e6b87/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.cc
[modify] https://crrev.com/265bb5a1bb62a04cfaebe0cda3b08c08383e6b87/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.h
[modify] https://crrev.com/265bb5a1bb62a04cfaebe0cda3b08c08383e6b87/gpu/command_buffer/service/gles2_cmd_decoder_unittest_drawing.cc
[modify] https://crrev.com/265bb5a1bb62a04cfaebe0cda3b08c08383e6b87/gpu/command_buffer/service/gles2_cmd_decoder_unittest_textures.cc