Float-cast-overflow in blink::WebGL2RenderingContextBase::SamplerParameter |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6727222816407552 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: blink::WebGL2RenderingContextBase::SamplerParameter samplerParameterfMethod blink::V8WebGL2RenderingContext::samplerParameterfMethodCallback Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:563900 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6727222816407552 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jun 20 2018
The issue is that "undefined" converts to NaN when coming in as a float, and there's an unchecked static_cast to GLint of that value.
,
Jun 22 2018
,
Jun 22 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/e844b9a623a1eabc7fac73e87d3c2d09a8e2c6d0 commit e844b9a623a1eabc7fac73e87d3c2d09a8e2c6d0 Author: Kenneth Russell <kbr@chromium.org> Date: Fri Jun 22 18:55:29 2018 Use base::saturated_cast to convert floating-point sampler parameter to int. Allow direct use of base/numerics/safe_conversions.h in Blink. Bug: 854710 Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel Change-Id: I43c664317beca77525fe65445a25da528c7747d5 Reviewed-on: https://chromium-review.googlesource.com/1109267 Commit-Queue: Kenneth Russell <kbr@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Reviewed-by: Zhenyao Mo <zmo@chromium.org> Cr-Commit-Position: refs/heads/master@{#569716} [modify] https://crrev.com/e844b9a623a1eabc7fac73e87d3c2d09a8e2c6d0/third_party/blink/renderer/DEPS [modify] https://crrev.com/e844b9a623a1eabc7fac73e87d3c2d09a8e2c6d0/third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.cc [modify] https://crrev.com/e844b9a623a1eabc7fac73e87d3c2d09a8e2c6d0/third_party/blink/tools/audit_non_blink_usage.py
,
Jun 22 2018
,
Jun 24 2018
ClusterFuzz has detected this issue as fixed in range 569715:569716. Detailed report: https://clusterfuzz.com/testcase?key=6727222816407552 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: blink::WebGL2RenderingContextBase::SamplerParameter samplerParameterfMethod blink::V8WebGL2RenderingContext::samplerParameterfMethodCallback Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:563900 Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=569715:569716 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6727222816407552 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jun 24 2018
ClusterFuzz testcase 6727222816407552 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Jun 20 2018Labels: Test-Predator-Auto-Components