New issue
Advanced search Search tips

Issue 795921 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

ASSERT: false

Project Member Reported by ClusterFuzz, Dec 18 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5134929469112320

Fuzzer: libFuzzer_gpu_swiftshader_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 0x000000000000
Crash State:
  false
  es2::Device::stretchRect
  es2::Texture2D::generateMipmaps
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5134929469112320

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
 
Project Member

Comment 1 by ClusterFuzz, Dec 18 2017

Components: Internals>GPU>Internals Internals>GPU>SwiftShader
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 2 by cthomp@chromium.org, Dec 19 2017

Owner: capn@chromium.org
capn@ Could you take a look, or help find an owner who can? I'm not sure what the effects of hitting the ASSERT (ERR) here are (or the effects of returning false in a non-debug build).

Comment 3 by capn@chromium.org, Dec 19 2017

Labels: -Security_Severity-High Security_Severity-Low Pri-2
Status: Assigned (was: Untriaged)
This seems relatively benign. The next line returns from the function and stops the creation of a mipmap level. It could result in a minor rendering artifact at worst, which we'll investigate.

Comment 4 by capn@chromium.org, Dec 19 2017

Cc: sugoi@chromium.org
Project Member

Comment 5 by ClusterFuzz, Jan 31 2018

Status: WontFix (was: Assigned)
ClusterFuzz testcase 5134929469112320 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Comment 6 by capn@chromium.org, Jan 31 2018

Status: Assigned (was: WontFix)
We should still look into how it's possible to hit this assert.
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam -Security_Severity-Low Type-Bug
Seems like this can be removed from the security queue based on c#3.

Sign in to add a comment