New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 820822 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Timeout in gpu_fuzzer

Project Member Reported by ClusterFuzz, Mar 11 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5683152115466240

Fuzzer: libFuzzer_gpu_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  gpu_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=523270:523295

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5683152115466240

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Cc: brajkumar@chromium.org
Components: Internals>GPU
Labels: -Pri-1 M-65 Test-Predator-Wrong CF-NeedsTriage Pri-2
Unable to find actual suspect through code search and also from the provided CL under regression range, hence adding appropriate label and leaving it as untriaged for further updates.

Thanks!
Cc: kylec...@chromium.org
Owner: kbr@chromium.org
Assigning to kbr for further triage. Do you know who is the right owner for this?
Status: Assigned (was: Untriaged)

Comment 4 by kbr@chromium.org, Mar 21 2018

Cc: kbr@chromium.org
Owner: piman@chromium.org
Sorry, I barely know how the GPU fuzzer works. Assigning to piman for triage.

Comment 5 by piman@chromium.org, Mar 21 2018

Components: -Internals>GPU Internals>GPU>Internals
I'll take a look, but FYI for next time, the CF report page lists the GN config used to build the fuzzer as well as the command line arguments (in case they matter), and has the test case, so reproducing it is generally fairly trivial. See also https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/README.md

Comment 6 by piman@chromium.org, Mar 21 2018

Cc: mmoroz@chromium.org
NextAction: 2018-03-28
Took a look and unfortunately what happens is that this is a legitimate heavy workload under asan debug. Basically the test case does a bunch of BufferData on the same buffer with a different size, which constantly resizes the shadow buffer (an unsigned char buffer). With libc++ and asan, in debug, this looks to do a fair amount of work on every single unsigned char added or removed, and I counted ~180MB of addition (and removals).

@mmoroz, do you think there's anything we can do at the tooling level to make this faster? Otherwise I'll just mark as wontfix.

Comment 7 by mmoroz@chromium.org, Mar 21 2018

piman@, right, debug build is fairly slow, but we keep it running on a small number of bots just to see which DCHECKs we may break. Please feel free to WontFix, since there is nothing wrong in fuzz target or the target code.

Comment 8 by piman@chromium.org, Mar 21 2018

Labels: ClusterFuzz-Ignore
Status: WontFix (was: Assigned)
The NextAction date has arrived: 2018-03-28
Project Member

Comment 10 by ClusterFuzz, Mar 28 2018

Labels: Needs-Feedback
ClusterFuzz testcase 5683152115466240 is still reproducing on tip-of-tree build (trunk).

If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase.

Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.

Comment 11 by piman@chromium.org, Mar 29 2018

Labels: -Needs-Feedback
NextAction: ----
@ClusterFuzz, please see comment #7. Oh, right, you can't read.
Project Member

Comment 12 by ClusterFuzz, Mar 31 2018

ClusterFuzz has detected this issue as fixed in range 547009:547024.

Detailed report: https://clusterfuzz.com/testcase?key=5683152115466240

Fuzzer: libFuzzer_gpu_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  gpu_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=523270:523295
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=547009:547024

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5683152115466240

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment