Null-dereference READ in GrDrawingManager::cleanup |
|||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5944317616324608 Fuzzer: lcamtuf_cross_fuzz Job Type: linux_asan_chrome_chromeos Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000038 Crash State: GrDrawingManager::cleanup GrContext::~GrContext GrDirectContext::~GrDirectContext Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=530651:530655 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5944317616324608 Additional requirements: Requires Gestures Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jan 20 2018
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
Jan 20 2018
Automatically adding ccs based on suspected regression changelists: Split GrContext into Normal/DDL flavors by robertphillips@google.com - https://skia.googlesource.com/skia/+/88260b549fcff1715ab9bb9b1a442e0abacce2e5 If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Jan 22 2018
Testcase 5944317616324608 is a top crash on ClusterFuzz for linux platform. Please prioritize fixing this crash. Marking this crash as a Beta release blocker. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jan 22 2018
The following revision refers to this bug: https://skia.googlesource.com/skia/+/2e6feed858c2b14b9083cf7d2b040a177dcb62ea commit 2e6feed858c2b14b9083cf7d2b040a177dcb62ea Author: Robert Phillips <robertphillips@google.com> Date: Mon Jan 22 21:14:35 2018 Fix crash in ~GrContext BUG=804352, 804111 Change-Id: Ia8475a4a8a6de77438cde7df53931dc70c405b16 Reviewed-on: https://skia-review.googlesource.com/98341 Reviewed-by: Greg Daniel <egdaniel@google.com> Commit-Queue: Robert Phillips <robertphillips@google.com> [modify] https://crrev.com/2e6feed858c2b14b9083cf7d2b040a177dcb62ea/src/gpu/GrContext.cpp
,
Jan 23 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/9efee54f4f8df2b0dea5cba3949eca64225eefc3 commit 9efee54f4f8df2b0dea5cba3949eca64225eefc3 Author: skia-deps-roller@chromium.org <skia-deps-roller@chromium.org> Date: Tue Jan 23 01:37:45 2018 Roll src/third_party/skia/ baafcdcd5..95bd38720 (6 commits) https://skia.googlesource.com/skia.git/+log/baafcdcd5435..95bd38720d8e $ git log baafcdcd5..95bd38720 --date=short --no-merges --format='%ad %ae %s' 2018-01-22 benjaminwagner Verify Status is showing new commits. 2018-01-22 reed check for huge paths 2018-01-22 fmalita Convert SVGPong sample to sksg 2018-01-22 halcanary SkQP: add some scripts for admin 2018-01-22 egdaniel Make use of VkSemaphores thread safe assuming use of the same VkQueue. 2018-01-22 robertphillips Fix crash in ~GrContext Created with: roll-dep src/third_party/skia BUG=804352, 804111 The AutoRoll server is located here: https://autoroll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel TBR=robertphillips@chromium.org Change-Id: I03057b65cec0f3975191a23510719f974d7650c8 Reviewed-on: https://chromium-review.googlesource.com/879088 Reviewed-by: Skia Deps Roller <skia-deps-roller@chromium.org> Commit-Queue: Skia Deps Roller <skia-deps-roller@chromium.org> Cr-Commit-Position: refs/heads/master@{#531118} [modify] https://crrev.com/9efee54f4f8df2b0dea5cba3949eca64225eefc3/DEPS
,
Jan 25 2018
How are the change listed at #5 and #6 looking canary? If canary result looks good, pls request a merge to M65. Thank you.
,
Jan 25 2018
FWIW, I believe Skia branch for m65 at: e201ebc Revert "Remove GrSurfaceProxy::MakeWrapped" by Robert Phillips · 8 days ago The CL in question here landed after Skia branched at: 88260b5 Split GrContext into Normal/DDL flavors by Robert Phillips · 6 days ago
,
Jan 25 2018
,
Jan 25 2018
Also, see crbug.com/804352
,
Jan 25 2018
I believe this was fixed in the 66.0.3329.0 build which contained the fix in #5 & #6. I don't know why clusterfuzz hasn't marked it as fixed.
,
Jan 25 2018
[Auto-generated comment by a script] We noticed that this issue is targeted for M-65; it appears the fix may have landed after branch point, meaning a merge might be required. Please confirm if a merge is required here - if so add Merge-Request-65 label, otherwise remove Merge-TBD label. Thanks.
,
Jan 26 2018
,
Jan 26 2018
We do not believe the problem or fix to be in M65 branch, this was found and addressed post Skia branch. Removing tag, no merges are required.
,
Jan 26 2018
ClusterFuzz has detected this issue as fixed in range 531113:531120. Detailed report: https://clusterfuzz.com/testcase?key=5944317616324608 Fuzzer: lcamtuf_cross_fuzz Job Type: linux_asan_chrome_chromeos Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000038 Crash State: GrDrawingManager::cleanup GrContext::~GrContext GrDirectContext::~GrDirectContext Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=530651:530655 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=531113:531120 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5944317616324608 Additional requirements: Requires Gestures See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by ClusterFuzz
, Jan 20 2018