New issue
Advanced search Search tips

Issue 825125 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

CHECK failure: IntRect() == MapUsingGeometryMapper(rect) ("0,0 0x0" vs. "88,NUMBER 532x0") in C

Project Member Reported by ClusterFuzz, Mar 23 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5804523529175040

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IntRect() == MapUsingGeometryMapper(rect) ("0,0 0x0" vs. "88,NUMBER 532x0") in C
  blink::ChunkToLayerMapper::MapVisualRect
  blink::CompositedLayerRasterInvalidator::PaintChunkInfo::PaintChunkInfo
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=543308:543309

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5804523529175040

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Mar 23 2018

Components: Blink>Internals>WTF Blink>Paint
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Mar 23 2018

Labels: Test-Predator-Auto-Owner
Owner: tkent@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/51dd1f7168bb9502d7e64ddf2a5eca62c4c688c7 (move_blink_source.py: Rename CSSOMFoo to cssom_foo).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

Comment 3 by tkent@chromium.org, Mar 23 2018

Components: -Blink>Internals>WTF
Labels: Test-Predator-Wrong-CLs
Owner: ----
Status: Untriaged (was: Assigned)
> Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/51dd1f7168bb9502d7e64ddf2a5eca62c4c688c7 (move_blink_source.py: Rename CSSOMFoo to cssom_foo).

Completely unrelated. The CL doesn't affect the current code at all.

Cc: wangxianzhu@chromium.org
Labels: -Pri-1 Pri-2
Owner: chrishtr@chromium.org
Status: Assigned (was: Untriaged)
Wondering if this could be the issue with chat.

Still, P2 for CHECK failures.
Project Member

Comment 5 by bugdroid1@chromium.org, Mar 30 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5d0efbc11065501cc2664769fefb4168d0dced60

commit 5d0efbc11065501cc2664769fefb4168d0dced60
Author: Chris Harrelson <chrishtr@chromium.org>
Date: Fri Mar 30 23:38:12 2018

[SPv175] Only check that the mapped rect is empty, not that it equals the empty rect.

Any empty rect suffices to make it correct to return the empty rect when
computing visual rects in graphics layer space.

Bug:825125

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I332183a7b31e877fef01bab91fd9e835b828b9e5
Reviewed-on: https://chromium-review.googlesource.com/987401
Commit-Queue: Tien-Ren Chen <trchen@chromium.org>
Reviewed-by: Tien-Ren Chen <trchen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#547320}
[modify] https://crrev.com/5d0efbc11065501cc2664769fefb4168d0dced60/third_party/WebKit/Source/platform/graphics/compositing/ChunkToLayerMapper.cpp

Status: Fixed (was: Assigned)
Project Member

Comment 7 by ClusterFuzz, Apr 14 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5804523529175040 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment