New issue
Advanced search Search tips

Issue 804111 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner: ----
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in GrDrawingManager::cleanup

Project Member Reported by ClusterFuzz, Jan 20 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5944317616324608

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000038
Crash State:
  GrDrawingManager::cleanup
  GrContext::~GrContext
  GrDirectContext::~GrDirectContext
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=530651:530655

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5944317616324608

Additional requirements: Requires Gestures

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jan 20 2018

Labels: OS-Mac
Project Member

Comment 2 by ClusterFuzz, Jan 20 2018

Components: Internals>Skia
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 3 by ClusterFuzz, Jan 20 2018

Cc: robertph...@google.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Split GrContext into Normal/DDL flavors by robertphillips@google.com - https://skia.googlesource.com/skia/+/88260b549fcff1715ab9bb9b1a442e0abacce2e5

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 4 by ClusterFuzz, Jan 22 2018

Labels: M-65 ReleaseBlock-Beta ClusterFuzz-Top-Crash
Testcase 5944317616324608 is a top crash on ClusterFuzz for linux platform. Please prioritize fixing this crash.

Marking this crash as a Beta release blocker.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 5 by bugdroid1@chromium.org, Jan 22 2018

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/2e6feed858c2b14b9083cf7d2b040a177dcb62ea

commit 2e6feed858c2b14b9083cf7d2b040a177dcb62ea
Author: Robert Phillips <robertphillips@google.com>
Date: Mon Jan 22 21:14:35 2018

Fix crash in ~GrContext

BUG=804352,  804111 
Change-Id: Ia8475a4a8a6de77438cde7df53931dc70c405b16
Reviewed-on: https://skia-review.googlesource.com/98341
Reviewed-by: Greg Daniel <egdaniel@google.com>
Commit-Queue: Robert Phillips <robertphillips@google.com>

[modify] https://crrev.com/2e6feed858c2b14b9083cf7d2b040a177dcb62ea/src/gpu/GrContext.cpp

Project Member

Comment 6 by bugdroid1@chromium.org, Jan 23 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9efee54f4f8df2b0dea5cba3949eca64225eefc3

commit 9efee54f4f8df2b0dea5cba3949eca64225eefc3
Author: skia-deps-roller@chromium.org <skia-deps-roller@chromium.org>
Date: Tue Jan 23 01:37:45 2018

Roll src/third_party/skia/ baafcdcd5..95bd38720 (6 commits)

https://skia.googlesource.com/skia.git/+log/baafcdcd5435..95bd38720d8e

$ git log baafcdcd5..95bd38720 --date=short --no-merges --format='%ad %ae %s'
2018-01-22 benjaminwagner Verify Status is showing new commits.
2018-01-22 reed check for huge paths
2018-01-22 fmalita Convert SVGPong sample to sksg
2018-01-22 halcanary SkQP: add some scripts for admin
2018-01-22 egdaniel Make use of VkSemaphores thread safe assuming use of the same VkQueue.
2018-01-22 robertphillips Fix crash in ~GrContext

Created with:
  roll-dep src/third_party/skia
BUG=804352, 804111 


The AutoRoll server is located here: https://autoroll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
TBR=robertphillips@chromium.org

Change-Id: I03057b65cec0f3975191a23510719f974d7650c8
Reviewed-on: https://chromium-review.googlesource.com/879088
Reviewed-by: Skia Deps Roller <skia-deps-roller@chromium.org>
Commit-Queue: Skia Deps Roller <skia-deps-roller@chromium.org>
Cr-Commit-Position: refs/heads/master@{#531118}
[modify] https://crrev.com/9efee54f4f8df2b0dea5cba3949eca64225eefc3/DEPS

Comment 7 by gov...@chromium.org, Jan 25 2018

How are the change listed at #5 and #6 looking canary? If canary result looks good, pls request a merge to M65. Thank you.
FWIW, I believe Skia branch for m65 at:

e201ebc Revert "Remove GrSurfaceProxy::MakeWrapped" by Robert Phillips · 8 days ago

The CL in question here landed after Skia branched at:

88260b5 Split GrContext into Normal/DDL flavors by Robert Phillips · 6 days ago

Cc: hcm@google.com
Also, see crbug.com/804352
Status: Fixed (was: Untriaged)
I believe this was fixed in the 66.0.3329.0 build which contained the fix in #5 & #6.

I don't know why clusterfuzz hasn't marked it as fixed.
Labels: Merge-TBD
[Auto-generated comment by a script] We noticed that this issue is targeted for M-65; it appears the fix may have landed after branch point, meaning a merge might be required. Please confirm if a merge is required here - if so add Merge-Request-65 label, otherwise remove Merge-TBD label. Thanks.
Labels: -Merge-TBD

Comment 14 by hcm@chromium.org, Jan 26 2018

Labels: -M-65
We do not believe the problem or fix to be in M65 branch, this was found and addressed post Skia branch.  Removing tag, no merges are required.
Project Member

Comment 15 by ClusterFuzz, Jan 26 2018

ClusterFuzz has detected this issue as fixed in range 531113:531120.

Detailed report: https://clusterfuzz.com/testcase?key=5944317616324608

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000038
Crash State:
  GrDrawingManager::cleanup
  GrContext::~GrContext
  GrDirectContext::~GrDirectContext
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=530651:530655
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=531113:531120

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5944317616324608

Additional requirements: Requires Gestures

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment