New issue
Advanced search Search tips

Issue 836664 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Float-cast-overflow in ClampedAlphaForBlending

Project Member Reported by ClusterFuzz, Apr 25 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5687112184365056

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  ClampedAlphaForBlending
  blink::ScaleAlpha
  blink::SVGPaintServer::ApplyToPaintFlags
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=552707:552711

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5687112184365056

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 25 2018

Components: Blink>Paint Blink>SVG
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Labels: ClusterFuzz-Ignore
Status: WontFix (was: Untriaged)
Overflow in setting up painting operations with very large inputs is generally not a problem.
Owner: fmalita@chromium.org
Status: Assigned (was: WontFix)
Maybe not a security issue, but it does seem like a correctness problem: there is now a discontinuity when the opacity overflows int.  E.g. it's weird for this to not render: <rect width="100" height="100" fill="green" fill-opacity="2147483647"/>

Per spec [1], "Any values outside the range 0.0 (fully transparent) to 1.0 (fully opaque) will be clamped to this range. "

[1] https://www.w3.org/TR/SVG11/masking.html#OpacityProperty
Sure, in theory we could deal with it and feel free to fix it if it's easy. I just do not want to encourage us to add code to detect overflow if it slows down everything else.
Right, we're already clamping, but in the wrong domain (after overflowing) -- so the fix should be trivial.
Project Member

Comment 6 by bugdroid1@chromium.org, Apr 27 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a90e721a814bc940ec67a8aa8e58d5d33ef63021

commit a90e721a814bc940ec67a8aa8e58d5d33ef63021
Author: Florin Malita <fmalita@chromium.org>
Date: Fri Apr 27 20:17:43 2018

Clean up skia_utils::ScaleAlpha

We currently expose a couple of alpha-scaling helpers:

 - ClampedAlphaForBlending: float_alpha[0..1] -> int_alpha[0..256]
 - ScaleAlpha: SkColor * int_alpha[0..256] -> SkColor
 - ScaleAlpha: SkColor * float_alpha[0..1] -> SkColor

Some problems:

 1) ClampedAlphaForBlending is prone to int overflows
 2) several clients take the [0..256] alpha and shoehorn it into a paint
    by clamping to 255; this is imprecise because the original [0..1]
    domain is still scaled to [0..256] instead of [0..255]
 3) in general, there is no reason to go through an intermediate/premature
    int quantization

This CL removes ClampedAlphaForBlending and the int-flavored ScaleAlpha
helper, and updates all clients to use the float ScaleAlpha version.  It
also refactors the implementation to clamp in float, before int conversion.

Bug:  836664 
Test: svg/custom/opacity-overflow.svg

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I2f27c7f606a6bc428dcd90543f583a9f207a58f1
Reviewed-on: https://chromium-review.googlesource.com/1028451
Reviewed-by: Stephen Chenney <schenney@chromium.org>
Reviewed-by: Fredrik Söderquist <fs@opera.com>
Reviewed-by: Justin Novosad <junov@chromium.org>
Commit-Queue: Florin Malita <fmalita@chromium.org>
Cr-Commit-Position: refs/heads/master@{#554478}
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/paint/invalidation/svg/paintorder-filtered-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/paint/invalidation/svg/repaint-paintorder-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/fast/canvas/drawImage-with-globalAlpha-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/W3C-SVG-1.1/filters-composite-02-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/W3C-SVG-1.1/filters-displace-01-f-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/W3C-SVG-1.1/filters-offset-01-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/W3C-SVG-1.1/filters-tile-01-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/W3C-SVG-1.1/masking-mask-01-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/W3C-SVG-1.1/painting-fill-05-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/W3C-SVG-1.1/text-text-08-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/as-background-image/svg-as-background-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/as-background-image/svg-as-background-6-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/batik/filters/filterRegions-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/batik/paints/patternRegionA-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/batik/text/textDecoration-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/carto.net/colourpicker-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/carto.net/combobox-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/custom/embedding-external-svgs-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/custom/getscreenctm-in-scrollable-div-area-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/custom/getscreenctm-in-scrollable-div-area-nested-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/custom/getscreenctm-in-scrollable-svg-area-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/filters/sourceAlpha-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/hixie/perf/002-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/bidi-text-query-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/combining-character-queries-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/ligature-queries-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacing-squeeze-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacing-squeeze-2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacing-squeeze-3-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacing-squeeze-4-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacing-stretch-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacing-stretch-2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacing-stretch-3-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacing-stretch-4-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacingAndGlyphs-squeeze-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacingAndGlyphs-squeeze-2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacingAndGlyphs-squeeze-3-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacingAndGlyphs-squeeze-4-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacingAndGlyphs-stretch-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacingAndGlyphs-stretch-2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacingAndGlyphs-stretch-3-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-textLength-spacingAndGlyphs-stretch-4-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-x-list-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-x-list-2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-x-list-3-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-x-list-4-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-x-list-with-tspans-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-x-list-with-tspans-2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-x-list-with-tspans-3-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/select-x-list-with-tspans-4-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/surrogate-pair-queries-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/text-fill-opacity-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/text/text-selection-text-08-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/transforms/text-with-mask-with-svg-transform-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/svg/wicd/test-scalable-background-image2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/virtual/disable-spv175/paint/invalidation/svg/paintorder-filtered-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/virtual/disable-spv175/paint/invalidation/svg/repaint-paintorder-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/linux/virtual/gpu/fast/canvas/drawImage-with-globalAlpha-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac-mac10.10/svg/text/combining-character-queries-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac-mac10.11/svg/text/surrogate-pair-queries-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac-mac10.12/svg/as-background-image/svg-as-background-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac-mac10.12/svg/as-background-image/svg-as-background-6-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac-mac10.12/svg/hixie/perf/002-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac-mac10.12/svg/text/combining-character-queries-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac-mac10.12/svg/text/ligature-queries-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac-mac10.12/svg/text/surrogate-pair-queries-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/fast/canvas/drawImage-with-globalAlpha-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/images/color-profile-background-image-cross-fade-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/images/color-profile-background-image-cross-fade-png-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/images/cross-fade-background-size-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/W3C-SVG-1.1/filters-composite-02-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/W3C-SVG-1.1/filters-displace-01-f-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/W3C-SVG-1.1/filters-offset-01-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/W3C-SVG-1.1/filters-tile-01-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/W3C-SVG-1.1/masking-mask-01-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/W3C-SVG-1.1/painting-fill-05-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/W3C-SVG-1.1/text-text-08-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/as-background-image/svg-as-background-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/as-background-image/svg-as-background-6-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/batik/filters/filterRegions-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/batik/paints/patternRegionA-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/batik/text/textDecoration-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/carto.net/colourpicker-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/carto.net/combobox-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/custom/embedding-external-svgs-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/custom/getscreenctm-in-scrollable-div-area-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/custom/getscreenctm-in-scrollable-div-area-nested-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/custom/getscreenctm-in-scrollable-svg-area-expected.png
[delete] https://crrev.com/5a5267ab58dd0310fc2b427db30de60c0eea4457/third_party/WebKit/LayoutTests/platform/mac/svg/custom/mask-with-all-units-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/filters/sourceAlpha-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/hixie/perf/002-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/bidi-text-query-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/combining-character-queries-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/ligature-queries-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacing-squeeze-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacing-squeeze-2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacing-squeeze-3-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacing-squeeze-4-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacing-stretch-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacing-stretch-2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacing-stretch-3-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacing-stretch-4-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacingAndGlyphs-squeeze-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacingAndGlyphs-squeeze-2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacingAndGlyphs-squeeze-3-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacingAndGlyphs-squeeze-4-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacingAndGlyphs-stretch-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacingAndGlyphs-stretch-2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacingAndGlyphs-stretch-3-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-textLength-spacingAndGlyphs-stretch-4-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-x-list-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-x-list-2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-x-list-3-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-x-list-4-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-x-list-with-tspans-1-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-x-list-with-tspans-2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-x-list-with-tspans-3-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/select-x-list-with-tspans-4-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/surrogate-pair-queries-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/text-fill-opacity-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/text/text-selection-text-08-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/transforms/text-with-mask-with-svg-transform-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/svg/wicd/test-scalable-background-image2-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/color-profile-background-image-cross-fade-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/color-profile-background-image-cross-fade-png-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/cross-fade-background-size-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/virtual/gpu-rasterization/images/color-profile-background-image-cross-fade-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/virtual/gpu-rasterization/images/color-profile-background-image-cross-fade-png-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/mac/virtual/gpu-rasterization/images/cross-fade-background-size-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/win/fast/canvas/drawImage-with-globalAlpha-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/win/images/color-profile-background-image-cross-fade-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/win/images/color-profile-background-image-cross-fade-png-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/win/images/cross-fade-background-size-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/win/svg/W3C-SVG-1.1/filters-composite-02-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/win/svg/W3C-SVG-1.1/filters-displace-01-f-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/win/svg/W3C-SVG-1.1/filters-offset-01-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58d5d33ef63021/third_party/WebKit/LayoutTests/platform/win/svg/W3C-SVG-1.1/filters-tile-01-b-expected.png
[modify] https://crrev.com/a90e721a814bc940ec67a8aa8e58
Status: Fixed (was: Assigned)
Project Member

Comment 8 by ClusterFuzz, Apr 28 2018

ClusterFuzz has detected this issue as fixed in range 554470:554494.

Detailed report: https://clusterfuzz.com/testcase?key=5687112184365056

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  ClampedAlphaForBlending
  blink::ScaleAlpha
  blink::SVGPaintServer::ApplyToPaintFlags
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=552707:552711
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=554470:554494

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5687112184365056

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Apr 28 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5687112184365056 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment