New issue
Advanced search Search tips

Issue 849016 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

Assert in fill_in_2D_gaussian_kernel

Project Member Reported by ClusterFuzz, Jun 2 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5293213028712448

Fuzzer: libFuzzer_paint_op_buffer_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x053900003c3a
Crash State:
  sk_abort_no_print
  fill_in_2D_gaussian_kernel
  fill_in_2D_gaussian_kernel
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=556180:556186

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5293213028712448

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jun 2 2018

Components: Internals>Skia
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jun 2 2018

Cc: enne@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Jun 2 2018

Cc: robertph...@google.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Make degenerate kernel in fill_in_2D_gaussian_kernel sum to 1 by robertphillips@google.com - https://skia.googlesource.com/skia/+/bd66caa7ac38b68487778064eab10d76bc1d2e48

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.

Comment 4 by enne@chromium.org, Jun 5 2018

Labels: -Pri-1 ClusterFuzz-Ignore Pri-3
Owner: robertphillips@chromium.org
Status: Assigned (was: Untriaged)
Summary: Assert in fill_in_2D_gaussian_kernel (was: Abrt in sk_abort_no_print)
This is asserting in https://skia.googlesource.com/skia/+/fd6a52cc84364208f65f1ee52644192d6855ab0e/src/gpu/effects/GrMatrixConvolutionEffect.cpp#225 because height is not 3.  Does this need to be && and not ||?  Or is the assert wrong?

(gdb) print sigmaX
$6 = 0.000244140625
(gdb) print sigmaY
$7 = 0.995895386
(gdb) print width
$8 = 3
(gdb) print height
$9 = 7

Marking this as a p3 as I don't think there's any security implications here.  This just seems like a bug you might want to look at.
Project Member

Comment 5 by bugdroid1@chromium.org, Jun 20 2018

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/4e962c6c248d60fa0b382050a566eed46f0fa10a

commit 4e962c6c248d60fa0b382050a566eed46f0fa10a
Author: Robert Phillips <robertphillips@google.com>
Date: Wed Jun 20 12:09:00 2018

Fix degenerate case handling in fill_in_2D_gaussian_kernel

Bug:  849016 
Change-Id: Icc46451acd83140cb86593195947efea7f83828d
Reviewed-on: https://skia-review.googlesource.com/135142
Commit-Queue: Robert Phillips <robertphillips@google.com>
Reviewed-by: Herb Derby <herb@google.com>

[modify] https://crrev.com/4e962c6c248d60fa0b382050a566eed46f0fa10a/src/gpu/effects/GrMatrixConvolutionEffect.cpp

Project Member

Comment 6 by bugdroid1@chromium.org, Jun 20 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1fc6ddaf15df3de70c5c5b0249dfe265b7c90c7f

commit 1fc6ddaf15df3de70c5c5b0249dfe265b7c90c7f
Author: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Wed Jun 20 15:50:44 2018

Roll src/third_party/skia 4359d529121f..53418da8c647 (6 commits)

https://skia.googlesource.com/skia.git/+log/4359d529121f..53418da8c647


git log 4359d529121f..53418da8c647 --date=short --no-merges --format='%ad %ae %s'
2018-06-20 mtklein@chromium.org exclude _none_imagefilters.cpp in Google3
2018-06-20 rmistry@google.com Fix license file in compute/skc/main.c
2018-06-20 rmistry@google.com [Bookmaker] Point to new fiddlecli location
2018-06-20 robertphillips@google.com Fix degenerate case handling in fill_in_2D_gaussian_kernel
2018-06-20 borenet@google.com Update skia swarming task template to git 2.17.1
2018-06-20 angle-skia-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com Roll third_party/externals/angle2 4004ae0e033a..a914f7ff310d (1 commits)


Created with:
  gclient setdep -r src/third_party/skia@53418da8c647

The AutoRoll server is located here: https://autoroll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel

BUG= chromium:849016 , chromium:847597 
TBR=kjlubick@chromium.org

Change-Id: I25d536203c78f4d829ab7a0bda506415688d9e87
Reviewed-on: https://chromium-review.googlesource.com/1107937
Reviewed-by: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#568856}
[modify] https://crrev.com/1fc6ddaf15df3de70c5c5b0249dfe265b7c90c7f/DEPS

Project Member

Comment 7 by ClusterFuzz, Jun 21 2018

ClusterFuzz has detected this issue as fixed in range 568854:568856.

Detailed report: https://clusterfuzz.com/testcase?key=5293213028712448

Fuzzer: libFuzzer_paint_op_buffer_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x053900003c3a
Crash State:
  sk_abort_no_print
  fill_in_2D_gaussian_kernel
  fill_in_2D_gaussian_kernel
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=556180:556186
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=568854:568856

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5293213028712448

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Jun 21 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5293213028712448 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment