New issue
Advanced search Search tips

Issue 819192 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Abrt in sk_abort_no_print

Project Member Reported by ClusterFuzz, Mar 6 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4707949321912320

Fuzzer: libFuzzer_color_transform_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x03e900004ab7
Crash State:
  sk_abort_no_print
  SkColorSpace_XYZ::onFromXYZD50
  void SkOnce::operator
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=504555:504585

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4707949321912320

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Mar 6 2018

Components: Internals>Skia
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 2 by hcm@chromium.org, Apr 9 2018

Cc: brianosman@chromium.org mtklein@chromium.org
+Brian and Mike for a look

Comment 3 by hcm@chromium.org, Apr 9 2018

Status: Available (was: Untriaged)
This looks like an SkDEBUGFAIL that we trigger when a color space has a non-invertible XYZ matrix. That's certainly likely in a fuzzing context, and not real likely in the real world. Even if it happens, our handling of it should be fine (we just default to sRGB). I'm going to just remove the crash in this case.
Cc: -brianosman@chromium.org
Owner: brianosman@chromium.org
Status: Assigned (was: Available)
Project Member

Comment 6 by bugdroid1@chromium.org, Apr 10 2018

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/ec172aac2c41175582c15edf4d31460e0e6c244f

commit ec172aac2c41175582c15edf4d31460e0e6c244f
Author: Brian Osman <brianosman@google.com>
Date: Tue Apr 10 11:17:27 2018

Remove SkDEBUGFAIL for non-invertible XYZ matrix

We have a reasonable fallback for this (extremely unlikely) scenario.

Bug:  chromium:819192 
Change-Id: I7a9a28c067fb029fd1000e1eeb488ede688fc3b2
Reviewed-on: https://skia-review.googlesource.com/119945
Reviewed-by: Mike Klein <mtklein@chromium.org>
Commit-Queue: Brian Osman <brianosman@google.com>

[modify] https://crrev.com/ec172aac2c41175582c15edf4d31460e0e6c244f/src/core/SkColorSpace_XYZ.cpp

Status: Fixed (was: Assigned)
Project Member

Comment 8 by bugdroid1@chromium.org, Apr 11 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f670615082257324fbe0105e7461803ae10cc942

commit f670615082257324fbe0105e7461803ae10cc942
Author: skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Wed Apr 11 09:31:33 2018

Roll src/third_party/skia/ 1eeeae049..ff7fa50f0 (21 commits)

https://skia.googlesource.com/skia.git/+log/1eeeae0491ba..ff7fa50f0c95

$ git log 1eeeae049..ff7fa50f0 --date=short --no-merges --format='%ad %ae %s'
2018-04-10 egdaniel Add ctor to GrVkImageInfo.
2018-04-10 liyuqian Merge drawDevice and respect ctm for the paint
2018-04-10 mtklein skcms→dff16bc express ApproximateCurve error in input units
2018-04-10 csmartdalton ccpr: Clip quadratic hulls more efficiently
2018-04-10 mtklein allow rolling from anywhere
2018-04-10 jvanverth Add initial support for simple concave shadows.
2018-04-10 mtklein skcms→9ff49a5 use GaussNewton for 7-parameter approx
2018-04-06 liyuqian Do not use CTM for drawDevice or drawSprite
2018-04-10 csmartdalton ccpr: Improve CPU checks for collinear points
2018-04-10 csmartdalton ccpr: Remove fCurrAnchorPoint from GrCCGeometry
2018-04-10 mtklein give skcms rolls a helpful commit msg
2018-04-08 update-skps Update SKP version
2018-04-10 robertphillips Remove extra Vulkan submitCommandBuffer from deleteTestingOnlyBackendTexture
2018-04-10 mtklein hard-roll skcms into Skia
2018-04-10 egdaniel Update getBackendInfo calls on GrBackendTexture to support VkImageLayout better.
2018-04-10 caryclark one more path is rect bug
2018-04-09 caryclark fix path to rect when missing close verb
2018-04-09 benjaminwagner Omit skbug6653 on internal device.
2018-04-09 brianosman Remove SkDEBUGFAIL for non-invertible XYZ matrix
2018-04-09 angle-skia-autoroll Roll third_party/externals/angle2/ 6c59e4a15..0ce016c1b (2 commits)
2018-04-06 reed identify interesting cubic points

Created with:
  roll-dep src/third_party/skia
BUG= chromium:824145 , chromium:824145 , chromium:819192 


The AutoRoll server is located here: https://autoroll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
TBR=borenet@chromium.org

Change-Id: If3760ced34d61fa366b7363a499b2fe04a8a450a
Reviewed-on: https://chromium-review.googlesource.com/1005807
Reviewed-by: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#549839}
[modify] https://crrev.com/f670615082257324fbe0105e7461803ae10cc942/DEPS

Project Member

Comment 9 by ClusterFuzz, Apr 12 2018

ClusterFuzz has detected this issue as fixed in range 549834:549842.

Detailed report: https://clusterfuzz.com/testcase?key=4707949321912320

Fuzzer: libFuzzer_color_transform_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x0539000006be
Crash State:
  sk_abort_no_print
  SkColorSpace_XYZ::onFromXYZD50
  void SkOnce::operator
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=504555:504585
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=549834:549842

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4707949321912320

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Apr 12 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 4707949321912320 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment