New issue
Advanced search Search tips

Issue 797521 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

CHECK failure: target == buffers[bound_buffer_]->target in test_web_graphics_context_3d.cc

Project Member Reported by ClusterFuzz, Dec 24 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6435429309218816

Fuzzer: libFuzzer_paint_op_buffer_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  target == buffers[bound_buffer_]->target in test_web_graphics_context_3d.cc
  cc::TestWebGraphicsContext3D::bufferData
  cc::TestGLES2Interface::BufferData
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=524136:524153

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6435429309218816

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Dec 24 2017

Components: Internals>Compositing Internals>GPU>Internals
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: kkaluri@chromium.org
Labels: M-65
Owner: zmo@chromium.org
Status: Assigned (was: Untriaged)
with reference to following  Issue 796042 , assigning it to the zmo@ 

zmo@ Could you please look into it

Thank You...

Comment 3 by zmo@chromium.org, Jan 5 2018

Cc: danakj@chromium.org piman@chromium.org enne@chromium.org
Labels: -Pri-1 Pri-2
This is purely a bug in test code.

See https://chromium-review.googlesource.com/c/chromium/src/+/851433 for a fix.

Comment 4 by piman@chromium.org, Jan 5 2018

Cc: vmp...@chromium.org
Fix looks good, but I'm somewhat afraid TestGLES2Interface/TestWebGraphicsContext3D wasn't really designed as a backend for Skia, we might end up running into many of those.

Comment 5 by enne@chromium.org, Jan 5 2018

This is the first one I've seen, to be honest.  Most of the debug failures by far are Skia asserts.
Project Member

Comment 6 by bugdroid1@chromium.org, Jan 5 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/93c6eb72692ba45cad2f4abd7b06a739a23c30b9

commit 93c6eb72692ba45cad2f4abd7b06a739a23c30b9
Author: Zhenyao Mo <zmo@chromium.org>
Date: Fri Jan 05 20:10:39 2018

test_web_graphics_context_3d over-simplifies caching of the bound buffers.

It assumes there is one single bound buffer. In reality, there is one single
bound buffer per target.

This caused the test case in the bug triggers a BufferData() call in skia
without BindBuffer() first, therefore triggering a DCHECK failure.

BUG= 797521 
TEST=bots,test case in the bug
R=danakj@chromium.org

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel
Change-Id: I371dda5ff21b415c33b17e2e4b185b52aa29febd
Reviewed-on: https://chromium-review.googlesource.com/851433
Commit-Queue: Zhenyao Mo <zmo@chromium.org>
Reviewed-by: danakj <danakj@chromium.org>
Cr-Commit-Position: refs/heads/master@{#527366}
[modify] https://crrev.com/93c6eb72692ba45cad2f4abd7b06a739a23c30b9/cc/test/test_web_graphics_context_3d.cc
[modify] https://crrev.com/93c6eb72692ba45cad2f4abd7b06a739a23c30b9/cc/test/test_web_graphics_context_3d.h

Comment 7 by zmo@chromium.org, Jan 5 2018

Status: Fixed (was: Assigned)
Project Member

Comment 8 by ClusterFuzz, Jan 6 2018

ClusterFuzz has detected this issue as fixed in range 527354:527370.

Detailed report: https://clusterfuzz.com/testcase?key=6435429309218816

Fuzzer: libFuzzer_paint_op_buffer_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  target == buffers[bound_buffer_]->target in test_web_graphics_context_3d.cc
  cc::TestWebGraphicsContext3D::bufferData
  cc::TestGLES2Interface::BufferData
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=524136:524153
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=527354:527370

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6435429309218816

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Jan 6 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 6435429309218816 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment