New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 835606 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Regression



Sign in to add a comment

CHECK failure: color_converison_successful in color_space_gamut.cc

Project Member Reported by ClusterFuzz, Apr 22 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6559157176762368

Fuzzer: libFuzzer_blink_png_decoder_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  color_converison_successful in color_space_gamut.cc
  blink::ColorSpaceUtilities::GetColorSpaceGamut
  blink::BitmapImageMetrics::CountImageGammaAndGamut
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=552556:552566

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6559157176762368

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 22 2018

Components: Blink>Paint Internals>Images>Codecs
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Apr 22 2018

Labels: Test-Predator-Auto-Owner
Owner: wangxianzhu@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/371ffcdbb5dca7fb1a0aeb53956905bb1d4f9fc5 ([SPv175] Repaint non-composited layer on layer visibility change).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Components: -Blink>Paint
Labels: Test-Predator-Wrong-CLs Test-Predator-Wrong-Components
Owner: ----
Status: Untriaged (was: Assigned)
Cc: junov@chromium.org brajkumar@chromium.org
Components: -Internals>Images>Codecs Blink>Canvas
Labels: -Type-Bug M-68 Type-Bug-Regression
Owner: zakerinasab@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.

Using Code Search for the file, "color_space_gamut.cc" suspecting the below Cl might have caused this issue

Suspect CL: https://chromium.googlesource.com/chromium/src/+/ea365a520d4ef1d4943179e060e0538f82738819%5E%21/third_party/WebKit/Source/platform/graphics/ColorSpaceGamut.cpp

zakerinasab@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!

 Issue 835601  has been merged into this issue.
Cc: ccameron@chromium.org
This is a little bit strange. I tried the code in a Skia fiddle and the color space conversion function returns true in the fiddle:

https://fiddle.skia.org/c/1b088e5b92ed4e9ee7f24aef331e11fa
Hm, in fact this is not conclusive, since in Blink we are not using Skia decoders.
Cc: brianosman@chromium.org
Cc: -brianosman@chromium.org zakerinasab@chromium.org
Owner: brianosman@chromium.org
Cc: mtklein@chromium.org
Project Member

Comment 12 by ClusterFuzz, Apr 24 2018

ClusterFuzz has detected this issue as fixed in range 553072:553094.

Detailed report: https://clusterfuzz.com/testcase?key=6559157176762368

Fuzzer: libFuzzer_blink_png_decoder_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  color_converison_successful in color_space_gamut.cc
  blink::ColorSpaceUtilities::GetColorSpaceGamut
  blink::BitmapImageMetrics::CountImageGammaAndGamut
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=552556:552566
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=553072:553094

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6559157176762368

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 13 by ClusterFuzz, Apr 24 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6559157176762368 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment