New issue
Advanced search Search tips

Issue 846014 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 2
Type: Bug



Sign in to add a comment

GrTessellator OOM on allocating edges

Project Member Reported by ClusterFuzz, May 23 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5980874102013952

Fuzzer: libFuzzer_paint_op_buffer_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Out-of-memory (exceeds 2048 MB)
Crash Address: 
Crash State:
  paint_op_buffer_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=555636:555647

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5980874102013952

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 23 2018

Components: Internals>Skia
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, May 23 2018

Cc: enne@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Jun 4 2018

Labels: OS-Mac

Comment 4 by enne@chromium.org, Jun 5 2018

Labels: -Pri-1 Pri-2
Owner: senorblanco@chromium.org
Status: Assigned (was: Untriaged)
Summary: GrTessellator OOM on allocating edges (was: Out-of-memory in paint_op_buffer_fuzzer)
senorblanco: this looks like you, via git blame.

It looks like clusterfuzz has found this case (again?) where it just keeps allocating edges and eventually runs out of memory.  Not sure if this is an infinite loop or just a degenerate case.  It seems like something you might want to look into though, so sending this your way.
Status: Started (was: Assigned)
Project Member

Comment 6 by bugdroid1@chromium.org, Jun 6 2018

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/e62999f6efcffb12eff9502ec3603a3ed50b6e32

commit e62999f6efcffb12eff9502ec3603a3ed50b6e32
Author: Stephen White <senorblanco@chromium.org>
Date: Wed Jun 06 15:01:41 2018

GrTessellator: yet another out-of-range splitting fix.

It's actually possible for an intersection to be out-of-range on both
the intersected edges (e.g., below both bottom points), because
floating point. So we need to clamp against both edges.

Bug:  846014 
Change-Id: I9fe25a1fcd3b5242af7b1ee36b17f1e968aeb836
Reviewed-on: https://skia-review.googlesource.com/132323
Reviewed-by: Brian Salomon <bsalomon@google.com>
Commit-Queue: Stephen White <senorblanco@chromium.org>

[modify] https://crrev.com/e62999f6efcffb12eff9502ec3603a3ed50b6e32/tests/TessellatingPathRendererTests.cpp
[modify] https://crrev.com/e62999f6efcffb12eff9502ec3603a3ed50b6e32/src/gpu/GrTessellator.cpp

Project Member

Comment 7 by bugdroid1@chromium.org, Jun 6 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b34141f7b3d0424af66932d308e76a8185108306

commit b34141f7b3d0424af66932d308e76a8185108306
Author: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Wed Jun 06 19:44:31 2018

Roll src/third_party/skia c27967f..f454bd3 (7 commits)

https://skia.googlesource.com/skia.git/+log/c27967f..f454bd3


git log c27967f..f454bd3 --date=short --no-merges --format='%ad %ae %s'
2018-06-06 mtklein@chromium.org rm TestConfigParsing
2018-06-06 senorblanco@chromium.org GrTessellator: yet another out-of-range splitting fix.
2018-06-06 fmalita@chromium.org Build skottie_tool on Linux only
2018-06-06 kjlubick@google.com Add fuzzer option for Blur w/o occluder
2018-06-06 halcanary@google.com Revert "Have draw(Text|PosText|PosTextH) use a single entry on the device"
2018-06-06 fmalita@chromium.org Harden SkPerlinNoiseShader StitchData initialization
2018-06-06 caryclark@skia.org work around  bug 8051 


Created with:
  gclient setdep -r src/third_party/skia@f454bd3

The AutoRoll server is located here: https://autoroll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel

BUG= chromium:846014 , chromium:846010 
TBR=halcanary@chromium.org

Change-Id: I131a101b1c9cdb346382716f685d65766994e5c3
Reviewed-on: https://chromium-review.googlesource.com/1089174
Reviewed-by: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#565005}
[modify] https://crrev.com/b34141f7b3d0424af66932d308e76a8185108306/DEPS

Project Member

Comment 8 by ClusterFuzz, Jun 7 2018

ClusterFuzz has detected this issue as fixed in range 564993:565005.

Detailed report: https://clusterfuzz.com/testcase?key=5980874102013952

Fuzzer: libFuzzer_paint_op_buffer_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Out-of-memory (exceeds 2048 MB)
Crash Address: 
Crash State:
  paint_op_buffer_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=555636:555647
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=564993:565005

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5980874102013952

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Jun 7 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 5980874102013952 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment