New issue
Advanced search Search tips

Issue 797264 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Undefined-shift in sw::Shader::declareSampler

Project Member Reported by ClusterFuzz, Dec 22 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5699638530408448

Fuzzer: libFuzzer_swiftshader_vertex_routine_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  sw::Shader::declareSampler
  glsl::OutputASM::declareUniform
  glsl::OutputASM::declareUniform
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=521492:521536

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5699638530408448

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Dec 22 2017

Components: Internals>GPU>SwiftShader
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: kkaluri@chromium.org
Labels: M-65
Owner: capn@chromium.org
Status: Assigned (was: Untriaged)
Since it is related to Swiftshader component, assigning it to capn@

capn@ could you please look into it


Thank You...

Comment 3 by capn@chromium.org, Jan 2 2018

Cc: capn@chromium.org
Owner: sugoi@chromium.org
Alexis is working on changes that should fix this.
Project Member

Comment 4 by bugdroid1@chromium.org, Jan 4 2018

The following revision refers to this bug:
  https://swiftshader.googlesource.com/SwiftShader.git/+/da163edbdc41cbccacfd526f51b2cd2a9b6267bf

commit da163edbdc41cbccacfd526f51b2cd2a9b6267bf
Author: Alexis Hetu <sugoi@google.com>
Date: Thu Jan 04 16:16:25 2018

Sampler allocation fix

Because samplers can be stored within structures, register
allocation of entire structures within the samplers registers
was pushing sampler indices outside of the allowed limit.
In order to solve this, sampler registers now exclusively
contain samplers, and utility functions to compute sampler
only type size were added to make this possible.

 Bug chromium:797264 

Change-Id: Ic5a6f09665c39661944444cd736547bce4dff2ab
Reviewed-on: https://swiftshader-review.googlesource.com/15728
Tested-by: Alexis Hétu <sugoi@google.com>
Reviewed-by: Nicolas Capens <nicolascapens@google.com>

[modify] https://crrev.com/da163edbdc41cbccacfd526f51b2cd2a9b6267bf/src/OpenGL/compiler/OutputASM.cpp
[modify] https://crrev.com/da163edbdc41cbccacfd526f51b2cd2a9b6267bf/src/OpenGL/compiler/OutputASM.h
[modify] https://crrev.com/da163edbdc41cbccacfd526f51b2cd2a9b6267bf/src/OpenGL/compiler/Types.h
[modify] https://crrev.com/da163edbdc41cbccacfd526f51b2cd2a9b6267bf/src/OpenGL/compiler/intermediate.h
[modify] https://crrev.com/da163edbdc41cbccacfd526f51b2cd2a9b6267bf/src/Shader/Shader.cpp
[modify] https://crrev.com/da163edbdc41cbccacfd526f51b2cd2a9b6267bf/src/Shader/VertexProgram.cpp

Project Member

Comment 5 by ClusterFuzz, Jan 13 2018

ClusterFuzz has detected this issue as fixed in range 529109:529114.

Detailed report: https://clusterfuzz.com/testcase?key=5699638530408448

Fuzzer: libFuzzer_swiftshader_vertex_routine_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  sw::Shader::declareSampler
  glsl::OutputASM::declareUniform
  glsl::OutputASM::declareUniform
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=521492:521536
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=529109:529114

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5699638530408448

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Jan 13 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5699638530408448 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment