Bus in blink::ImageFrameGenerator::DecodeAndScale |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4699807122456576 Fuzzer: noel-image-flip Job Type: linux_ubsan_vptr_chrome Platform Id: linux Crash Type: Bus Crash Address: 0x7fbfa459c000 Crash State: blink::ImageFrameGenerator::DecodeAndScale blink::DecodingImageGenerator::GetPixels cc::PaintImage::DecodeFromGenerator Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=511048:511049 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4699807122456576 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Feb 16 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/6e0fe05135f93c0396ded47ded2731467d88b96d (Use AXEventGenerator in content/browser/accessibility). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Feb 20 2018
Bisect seems very likely wrong. I'll look at it.
,
Feb 23 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/01a14ca4de0d5e9ba6c3ae31fbd41ef05fe05c0f commit 01a14ca4de0d5e9ba6c3ae31fbd41ef05fe05c0f Author: Stephen Chenney <schenney@chromium.org> Date: Fri Feb 23 16:03:52 2018 [PE] Check for a valid allocation in DoDecodeImage Evidence suggests that very large images can cause us to have bad pixel data downstream from a DoDecodeImage call, and the bad memory comes from the discardable memory allocation. So check for that. BUG= 813240 R=vmpstr@chromium.org Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2 Change-Id: I945a2766d30382a10ae2039b057b0e5d47a8ce65 Reviewed-on: https://chromium-review.googlesource.com/927122 Reviewed-by: vmpstr <vmpstr@chromium.org> Commit-Queue: Stephen Chenney <schenney@chromium.org> Cr-Commit-Position: refs/heads/master@{#538789} [modify] https://crrev.com/01a14ca4de0d5e9ba6c3ae31fbd41ef05fe05c0f/cc/tiles/software_image_decode_cache_utils.cc
,
Mar 30 2018
ClusterFuzz testcase 4699807122456576 is flaky and no longer crashes, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Feb 16 2018Labels: Test-Predator-Auto-Components