New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 854710 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
OOO until 2019-01-24
Closed: Jun 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug

Blocking:
issue 855313



Sign in to add a comment

Float-cast-overflow in blink::WebGL2RenderingContextBase::SamplerParameter

Project Member Reported by ClusterFuzz, Jun 20 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6727222816407552

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::WebGL2RenderingContextBase::SamplerParameter
  samplerParameterfMethod
  blink::V8WebGL2RenderingContext::samplerParameterfMethodCallback
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:563900

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6727222816407552

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jun 20 2018

Components: Blink>WebGL
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 2 by kbr@chromium.org, Jun 20 2018

Owner: kbr@chromium.org
Status: Started (was: Untriaged)
The issue is that "undefined" converts to NaN when coming in as a float, and there's an unchecked static_cast to GLint of that value.

Comment 3 by kbr@chromium.org, Jun 22 2018

Blocking: 855313
Project Member

Comment 4 by bugdroid1@chromium.org, Jun 22 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e844b9a623a1eabc7fac73e87d3c2d09a8e2c6d0

commit e844b9a623a1eabc7fac73e87d3c2d09a8e2c6d0
Author: Kenneth Russell <kbr@chromium.org>
Date: Fri Jun 22 18:55:29 2018

Use base::saturated_cast to convert floating-point sampler parameter to int.

Allow direct use of base/numerics/safe_conversions.h in Blink.

Bug:  854710 
Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel
Change-Id: I43c664317beca77525fe65445a25da528c7747d5
Reviewed-on: https://chromium-review.googlesource.com/1109267
Commit-Queue: Kenneth Russell <kbr@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Zhenyao Mo <zmo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#569716}
[modify] https://crrev.com/e844b9a623a1eabc7fac73e87d3c2d09a8e2c6d0/third_party/blink/renderer/DEPS
[modify] https://crrev.com/e844b9a623a1eabc7fac73e87d3c2d09a8e2c6d0/third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.cc
[modify] https://crrev.com/e844b9a623a1eabc7fac73e87d3c2d09a8e2c6d0/third_party/blink/tools/audit_non_blink_usage.py

Comment 5 by kbr@chromium.org, Jun 22 2018

Status: Fixed (was: Started)
Project Member

Comment 6 by ClusterFuzz, Jun 24 2018

ClusterFuzz has detected this issue as fixed in range 569715:569716.

Detailed report: https://clusterfuzz.com/testcase?key=6727222816407552

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::WebGL2RenderingContextBase::SamplerParameter
  samplerParameterfMethod
  blink::V8WebGL2RenderingContext::samplerParameterfMethodCallback
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:563900
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=569715:569716

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6727222816407552

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Jun 24 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 6727222816407552 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment