New issue
Advanced search Search tips

Issue 844295 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: false in resource_format_utils.cc

Project Member Reported by ClusterFuzz, May 18 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5397922150350848

Fuzzer: libFuzzer_gpu_raster_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false in resource_format_utils.cc
  viz::TextureStorageFormat
  gpu::raster::RasterDecoderImpl::TexStorage2D
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=559059:559067

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5397922150350848

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 18 2018

Components: Internals>Compositing Internals>GPU>Internals
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, May 18 2018

Cc: piman@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, May 18 2018

Labels: Test-Predator-Auto-Owner
Owner: backer@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/a210e801d2389b72e762a446be8651700a71b330 (Cluster fuzz RasterDecoder).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

Comment 4 by backer@chromium.org, May 24 2018

Status: Started (was: Assigned)
Project Member

Comment 5 by bugdroid1@chromium.org, Jun 4 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/390ffc84a086f23d502097da14fea80a68c1b795

commit 390ffc84a086f23d502097da14fea80a68c1b795
Author: Jonathan Backer <backer@chromium.org>
Date: Mon Jun 04 17:57:20 2018

Fix clusterfuzz bugs

We were hitting DCHECKS on bad user input. This is the wrong thing to do
with input from an untrusted client. This CL validates the user input
and sets a local GL error instead.

1) glTexStorage2D does not support compressed formats, so fail for ETC1

2) often cannot handle more than 1 level, so return an error instead of
   DCHECK

3) only call Texture::SetImmutable if a level was successfully defined

Bug:  844295 ,  844296 ,  844293 
Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel
Change-Id: I0db5de0508c555b50bb0f3eb379aa5d5bfdd4cc6
Reviewed-on: https://chromium-review.googlesource.com/1071711
Commit-Queue: Jonathan Backer <backer@chromium.org>
Reviewed-by: Victor Miura <vmiura@chromium.org>
Cr-Commit-Position: refs/heads/master@{#564149}
[modify] https://crrev.com/390ffc84a086f23d502097da14fea80a68c1b795/gpu/command_buffer/service/raster_decoder.cc
[modify] https://crrev.com/390ffc84a086f23d502097da14fea80a68c1b795/gpu/command_buffer/service/raster_decoder_unittest.cc
[modify] https://crrev.com/390ffc84a086f23d502097da14fea80a68c1b795/gpu/command_buffer/service/raster_decoder_unittest_base.cc

Status: Fixed (was: Started)
Project Member

Comment 7 by ClusterFuzz, Jun 5 2018

ClusterFuzz has detected this issue as fixed in range 564134:564157.

Detailed report: https://clusterfuzz.com/testcase?key=5397922150350848

Fuzzer: libFuzzer_gpu_raster_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false in resource_format_utils.cc
  viz::TextureStorageFormat
  gpu::raster::RasterDecoderImpl::TexStorage2D
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=559059:559067
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=564134:564157

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5397922150350848

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Jun 5 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5397922150350848 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment