New issue
Advanced search Search tips

Issue 835666 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: xform_apply_result in color_transform.cc

Project Member Reported by ClusterFuzz, Apr 22 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4751637101674496

Fuzzer: libFuzzer_color_transform_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  xform_apply_result in color_transform.cc
  gfx::SkiaColorTransform::Transform
  gfx::ColorTransformInternal::Transform
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=552556:552566

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4751637101674496

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 22 2018

Components: UI>GFX
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Apr 22 2018

Cc: brianosman@google.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Enable skcms in Skia by brianosman@google.com - https://chromium.googlesource.com/chromium/src/+/a3796c2471b11c81c8b532d66388c1b5ea708c07

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Cc: -brianosman@google.com
Owner: brianosman@chromium.org
Status: Assigned (was: Untriaged)
Cc: mtklein@chromium.org
Project Member

Comment 5 by bugdroid1@chromium.org, Apr 23 2018

The following revision refers to this bug:
  https://skia.googlesource.com/skcms/+/71966da6705d6e49b518e56bb829708b797b67b9

commit 71966da6705d6e49b518e56bb829708b797b67b9
Author: Mike Klein <mtklein@chromium.org>
Date: Mon Apr 23 14:39:38 2018

fail skcms_Parse() for useless profiles

If we don't have an A2B or TRC+XYZ, we can't do anything with the
profile.  We'll still skcms_Parse() it out, but return false.

Before this CL, we parsed this as

                    Size : 0x0000020C : 524
        Data color space : 0x52474220 : 'RGB '
                     PCS : 0x58595A20 : 'XYZ '
               Tag count : 0x0000000A : 10

     Tag    : Type   : Size   : Offset
     ------ : ------ : ------ : --------
     'desc' : 'de{c' :     94 : 252
     'cprt' : 'text' :     11 : 348
     'wtpt' : 'Z' :     20 : 360
     'bkpt' : 'XYZ ' :     20 : 380
     'rXYZ' : 'XYZ ' :     20 : 400
     'gXYZ' : 'XYZ ' :     20 : 420
     'bXYZ' : 'XYZ ' :     20 : 440
     'rT' : 'curv' :     64 : 460
     'gTRC' : '' :     64 : 456
     'bTRC' : 'curv' :     64 : 460

    Best : 2.4, 0.947867, 0.0521327, 0.0773994, 0.04045, 0, 0 (D-gap: -1.28057e-08)
     ~13 : 0.305657x^3 + 0.681706x^2 + 0.0126377x (Max error: 0.00166378)
     XYZ : | 0.436065674 0.385147095 0.143066406 |
           | 0.222488403 0.716873169 0.060607910 |
           | 0.013916016 0.097076416 0.714096069 |
    We can parse this profile, but not transform it XYZD50!

Bug:  chromium:835666 

Change-Id: I70d23108c38dcf2c617a5062a4d2b3a712587548
Reviewed-on: https://skia-review.googlesource.com/122951
Auto-Submit: Mike Klein <mtklein@chromium.org>
Commit-Queue: Brian Osman <brianosman@google.com>
Reviewed-by: Brian Osman <brianosman@google.com>

[add] https://crrev.com/71966da6705d6e49b518e56bb829708b797b67b9/profiles/fuzz/mangled_trc_tags.icc
[modify] https://crrev.com/71966da6705d6e49b518e56bb829708b797b67b9/src/ICCProfile.c
[add] https://crrev.com/71966da6705d6e49b518e56bb829708b797b67b9/profiles/fuzz/mangled_trc_tags.icc.txt
[modify] https://crrev.com/71966da6705d6e49b518e56bb829708b797b67b9/tests.c

Project Member

Comment 6 by bugdroid1@chromium.org, Apr 23 2018

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/b7eace414d9239b146fc8ec1a259eeacbd9508df

commit b7eace414d9239b146fc8ec1a259eeacbd9508df
Author: Brian Osman <brianosman@google.com>
Date: Mon Apr 23 14:46:30 2018

Reject XYZ profiles missing some (or all) TRC tags

The previous behavior isn't justified by the spec, and doesn't match
skcms' behavior. To ease migration and avoid discrepancy when dealing
with fuzzer-generated profiles, enforce the stricter rules here.

Bug:  chromium:835666 
Change-Id: Ice6452b521a737d6dc339571dcbb313567235ed6
Reviewed-on: https://skia-review.googlesource.com/122952
Commit-Queue: Brian Osman <brianosman@google.com>
Commit-Queue: Mike Klein <mtklein@chromium.org>
Auto-Submit: Brian Osman <brianosman@google.com>
Reviewed-by: Mike Klein <mtklein@chromium.org>

[modify] https://crrev.com/b7eace414d9239b146fc8ec1a259eeacbd9508df/src/core/SkColorSpace_ICC.cpp

Status: Fixed (was: Assigned)
Project Member

Comment 8 by bugdroid1@chromium.org, Apr 24 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8113f13991449c362fc3a44499c99e5b059e7200

commit 8113f13991449c362fc3a44499c99e5b059e7200
Author: skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Tue Apr 24 14:17:32 2018

Roll src/third_party/skia/ 78fb04e69..af88ec371 (48 commits; 2 trivial rolls)

https://skia.googlesource.com/skia.git/+log/78fb04e69eae..af88ec371248

$ git log 78fb04e69..af88ec371 --date=short --no-merges --format='%ad %ae %s'
2018-04-24 mtklein Revert "Add arcs as a specialized geometry to GrShape."
2018-04-24 csmartdalton Revert "ccpr: Don't preempt the convex path renderer"
2018-04-24 skcms-skia-autoroll Roll skia/third_party/skcms e492929..6a4194e (1 commits)
2018-04-24 mtklein Revert "call skcms_OptimizeForSpeed()"
2018-04-23 mtklein Revert "Reland "Exercise the threaded backend in test bots""
2018-04-23 skcms-skia-autoroll Roll skia/third_party/skcms e8bc226..e492929 (1 commits)
2018-04-23 bsalomon Add arcs as a specialized geometry to GrShape.
2018-04-23 mtklein call skcms_OptimizeForSpeed()
2018-04-23 angle-skia-autoroll Roll third_party/externals/angle2/ 40786bdfc..b3474d9d7 (6 commits)
2018-04-23 liyuqian Reland "Exercise the threaded backend in test bots"
2018-04-23 liyuqian Fix variable name collision
2018-04-23 halcanary SkBitSet: make movable.
2018-04-23 brianosman Add skcms include directory for Android framework builds
2018-04-23 skcms-skia-autoroll Roll skia/third_party/skcms fe14a6a..e8bc226 (1 commits)
2018-04-23 robertphillips Suppress BlurMaskBiggerThanDest on NexusPlayer for Vulkan
2018-04-23 jvanverth Revert "Remove ambient clamp hack for analytic shadows."
2018-04-18 csmartdalton ccpr: Don't call calcCubicInverseTransposePowerBasisMatrix
2018-04-23 skcms-skia-autoroll Roll skia/third_party/skcms f1a2ba9..fe14a6a (1 commits)
2018-04-23 brianosman Enable skcms by default
2018-04-23 halcanary SkPDF: Don't forget to upcast before shift.
2018-04-23 liyuqian Clip the SkAntiRect because of possible tilings
2018-04-23 herb Generalize to SkDescriptorMap
2018-04-23 brianosman Use relative path to skcms GN file
2018-04-23 brianosman Fix deprecated constructor usage
2018-04-23 bungeman Add Transform section to viewer tools window.
2018-04-23 reed use SkRect::outset, as it clamps on overflow
2018-04-23 skcms-skia-autoroll Roll skia/third_party/skcms 17d4b82..f1a2ba9 (1 commits)
2018-04-23 reed Rewrite CHECK_INTERSECT to perform the !(opposite) predicate, so that we return false if either argument is NaN.
2018-04-23 skcms-skia-autoroll Roll skia/third_party/skcms 71966da..17d4b82 (1 commits)
2018-04-23 egdaniel Fixes in ReadPixels2 and yuv_texture gm to fix Vulkan validation issues.
2018-04-23 robertphillips Reland "Prevent masked solid-color draws from being turned into clears"
2018-04-23 robertphillips Disable BlurMaskBiggerThanDest unit test on ANGLE
2018-04-23 skcms-skia-autoroll Roll skia/third_party/skcms c4941e8..71966da (1 commits)
2018-04-20 benjaminwagner Add SwiftShader Test jobs.
2018-04-23 bungeman Backspace opens slide picker (not paint) in viewer.
2018-04-23 brianosman Reject XYZ profiles missing some (or all) TRC tags
2018-04-20 scroggo (Mostly) respect FilterQuality in draw[stretchy]
2018-04-23 borenet [infra] Fast-forward recipes, re-enable roller
2018-04-23 robertphillips Revert "Prevent masked solid-color draws from being turned into clears"
2018-04-23 skcms-skia-autoroll Roll skia/third_party/skcms e658346..c4941e8 (1 commits)
2018-04-23 angle-skia-autoroll Roll third_party/externals/angle2/ 505ea1bb5..40786bdfc (3 commits)
2018-04-23 rmistry Remove Android compile bot from the CQ
2018-04-23 borenet Switch RecreateSKPs and Bookmaker bots to use service accounts
2018-04-23 borenet Remove UpdateMetaConfig bot
2018-04-20 robertphillips Disable threaded SW mask generation on DDL bots
2018-04-23 robertphillips Prevent masked solid-color draws from being turned into clears

Created with:
  roll-dep src/third_party/skia
BUG= chromium:835666 ,chromium:b/77917978


The AutoRoll server is located here: https://autoroll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel
TBR=stani@chromium.org

Change-Id: I2d3ce75f62d13529ad35a13fa78a62e6da15c08e
Reviewed-on: https://chromium-review.googlesource.com/1025319
Reviewed-by: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Reviewed-by: Mike Klein <mtklein@chromium.org>
Commit-Queue: Mike Klein <mtklein@chromium.org>
Cr-Commit-Position: refs/heads/master@{#553091}
[modify] https://crrev.com/8113f13991449c362fc3a44499c99e5b059e7200/DEPS

Project Member

Comment 9 by ClusterFuzz, Apr 25 2018

ClusterFuzz has detected this issue as fixed in range 553072:553094.

Detailed report: https://clusterfuzz.com/testcase?key=4751637101674496

Fuzzer: libFuzzer_color_transform_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  xform_apply_result in color_transform.cc
  gfx::SkiaColorTransform::Transform
  gfx::ColorTransformInternal::Transform
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=552556:552566
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=553072:553094

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4751637101674496

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Apr 25 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 4751637101674496 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment