Float-cast-overflow in blink::FilterEffectBuilder::BuildFilterOperations |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5104524432506880 Fuzzer: ifratric-browserfuzzer-v3 Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: blink::FilterEffectBuilder::BuildFilterOperations blink::PaintLayer::UpdateCompositorFilterOperationsForFilter blink::CompositedLayerMapping::UpdateFilters Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=552707:552711 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5104524432506880 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Apr 25 2018
Overflow in setting up painting operations with very large inputs is generally not a problem.
,
May 2 2018
ClusterFuzz testcase 5104524432506880 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
,
May 2 2018
Float cast to WebPoint, which should really just be an IntPoint, I think. So it could be fixed.
,
May 2 2018
,
May 2 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/e26e6240764674f6c669d55a950f1fcc07249966 commit e26e6240764674f6c669d55a950f1fcc07249966 Author: Fredrik Söderquist <fs@opera.com> Date: Wed May 02 19:16:33 2018 Fix drop-shadow(...) offset int conversion in FilterEffectBuilder Avoid the implicit conversion to int in the constructor for WebPoint. Also don't pass through WebPoint at all since AppendDropShadowFilter take an IntPoint. Bug: 836480 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2 Change-Id: I2c05681c686cf9f7169c79cf5f67849f483f36f8 Reviewed-on: https://chromium-review.googlesource.com/1039829 Reviewed-by: Stephen Chenney <schenney@chromium.org> Commit-Queue: Fredrik Söderquist <fs@opera.com> Cr-Commit-Position: refs/heads/master@{#555499} [modify] https://crrev.com/e26e6240764674f6c669d55a950f1fcc07249966/third_party/blink/renderer/core/paint/filter_effect_builder.cc
,
May 3 2018
ClusterFuzz has detected this issue as fixed in range 555498:555499. Detailed report: https://clusterfuzz.com/testcase?key=5104524432506880 Fuzzer: ifratric-browserfuzzer-v3 Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: blink::FilterEffectBuilder::BuildFilterOperations blink::PaintLayer::UpdateCompositorFilterOperationsForFilter blink::CompositedLayerMapping::UpdateFilters Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=552707:552711 Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=555498:555499 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5104524432506880 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
May 3 2018
ClusterFuzz testcase 5104524432506880 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, Apr 24 2018Labels: Test-Predator-Auto-Components