New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 802240 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: args.width > 0 && args.height > 0 && args.depth > 0 in texture_manager.cc

Project Member Reported by ClusterFuzz, Jan 16 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4545465424281600

Fuzzer: libFuzzer_gpu_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  args.width > 0 && args.height > 0 && args.depth > 0 in texture_manager.cc
  gpu::gles2::TextureManager::DoTexSubImageWithAlignmentWorkaround
  gpu::gles2::TextureManager::ValidateAndDoTexImage
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=527439:527468

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4545465424281600

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jan 16 2018

Components: Internals>GPU>Internals
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jan 16 2018

Cc: shiris...@amd.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Fix WebGL performance regression on AMD Stoney platform by shirish.s@amd.com - https://chromium.googlesource.com/chromium/src/+/57d32bfc804544458a698295d97529a058009990

If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
My CL: Fix WebGL performance regression on AMD Stoney platform by shirish.s@amd.com - https://chromium.googlesource.com/chromium/src/+/57d32bfc804544458a698295d97529a058009990 
is not applicable to chromeos only for AMD(stoney) platform.

If there is any regression post this patch ideally, the original patch that switches MSAA to 8x needs to be checked here:
"cdc786f5d2a2b538f4914ba0afbaee15634206b9 Use 8x MSAA rather than 4x MSAA when available." 

Am not able to cc kbr@chromium.org, can anyone add?

Comment 4 by piman@chromium.org, Jan 19 2018

Cc: piman@chromium.org
Labels: Test-Predator-Wrong-CLs
Owner: zmo@chromium.org
Status: Assigned (was: Untriaged)
That CL isn't the culprit, bisect stops there because it changes the workarounds list, which probably means this case triggers with specific workarounds (not necessarily this one, but if the list change, we may interpret the source data differently).

Probably missing some validation somewhere.
Project Member

Comment 5 by bugdroid1@chromium.org, Jan 24 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c172ef9265ba091d90c6af8a447612a1ccb599d8

commit c172ef9265ba091d90c6af8a447612a1ccb599d8
Author: Zhenyao Mo <zmo@chromium.org>
Date: Wed Jan 24 03:10:15 2018

Don't trigger tex unpack parameter workaround if dimension is 0.

BUG= 802240 
TEST=test case in the bug
R=piman@chromium.org
NOTRY=true

Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
Change-Id: I708a89f24151e5b0e75de65c0385acd37fbfffb3
Reviewed-on: https://chromium-review.googlesource.com/882210
Commit-Queue: Zhenyao Mo <zmo@chromium.org>
Reviewed-by: Antoine Labour <piman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#531406}
[modify] https://crrev.com/c172ef9265ba091d90c6af8a447612a1ccb599d8/gpu/command_buffer/service/texture_manager.cc

Project Member

Comment 6 by ClusterFuzz, Jan 24 2018

ClusterFuzz has detected this issue as fixed in range 531405:531429.

Detailed report: https://clusterfuzz.com/testcase?key=4545465424281600

Fuzzer: libFuzzer_gpu_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  args.width > 0 && args.height > 0 && args.depth > 0 in texture_manager.cc
  gpu::gles2::TextureManager::DoTexSubImageWithAlignmentWorkaround
  gpu::gles2::TextureManager::ValidateAndDoTexImage
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=527439:527468
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=531405:531429

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4545465424281600

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Jan 24 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4545465424281600 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment