New issue
Advanced search Search tips

Issue 853491 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: 0 == memcmp(serialized2.get(), serialized3.get(), written_bytes2) in paint_op_bu

Project Member Reported by ClusterFuzz, Jun 16 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6044434282840064

Fuzzer: libFuzzer_paint_op_buffer_eq_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  0 == memcmp(serialized2.get(), serialized3.get(), written_bytes2) in paint_op_bu
  paint_op_buffer_eq_fuzzer.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=558076:558096

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6044434282840064

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jun 16 2018

Components: Internals>Compositing
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jun 16 2018

Cc: enne@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Jun 16 2018

Labels: Test-Predator-Auto-Owner
Owner: khushals...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/694fc8b87c14ca162c353500625090bd6069ee0f (cc: Ensure color space for SerializeOptions in TestOptionsProvider.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 4 by bugdroid1@chromium.org, Jun 22 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/abff3935fe2736269e1c0ae01cd24d666d1f7c3c

commit abff3935fe2736269e1c0ae01cd24d666d1f7c3c
Author: Khushal <khushalsagar@chromium.org>
Date: Fri Jun 22 01:20:52 2018

cc: Fix PaintImage deserialization using TransferCache.

If we have a valid transfer cache entry but it doesn't exist in the
cache, we proceed with using an empty image. Since any referenced
entries must be serialized and locked with each command, it should be
considered an error.

R=ericrk@chromium.org

Bug:  853491 
Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I328d441163aa290693efd4870aeb3717c1586163
Reviewed-on: https://chromium-review.googlesource.com/1108556
Reviewed-by: Eric Karl <ericrk@chromium.org>
Commit-Queue: Khushal <khushalsagar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#569490}
[modify] https://crrev.com/abff3935fe2736269e1c0ae01cd24d666d1f7c3c/cc/paint/paint_op_reader.cc

Project Member

Comment 5 by ClusterFuzz, Jun 22 2018

ClusterFuzz has detected this issue as fixed in range 569485:569506.

Detailed report: https://clusterfuzz.com/testcase?key=6044434282840064

Fuzzer: libFuzzer_paint_op_buffer_eq_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  0 == memcmp(serialized2.get(), serialized3.get(), written_bytes2) in paint_op_bu
  paint_op_buffer_eq_fuzzer.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=558076:558096
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=569485:569506

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6044434282840064

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Jun 22 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6044434282840064 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment