New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 859458 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 859623
Owner: ----
Closed: Jul 22
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in bool blink::WebGLRenderingContextBase::ValidateTexImageSubRectangle<blink::Image

Project Member Reported by ClusterFuzz, Jul 2

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5984810875748352

Fuzzer: inferno_twister_c
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  bool blink::WebGLRenderingContextBase::ValidateTexImageSubRectangle<blink::Image
  blink::WebGLRenderingContextBase::TexImageHelperHTMLCanvasElement
  blink::WebGL2RenderingContextBase::texSubImage3D
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=567361:567363

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5984810875748352

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jul 2

Components: Blink>WebGL
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: kkaluri@chromium.org
Labels: M-68 Test-Predator-Wrong CF-NeedsTriage
Unable to find actual suspect through code search and also observing no CL's under regression range, hence adding appropriate label and requesting someone from dev team to look in to this issue.

Thanks!
Cc: kbr@chromium.org kainino@chromium.org jdarpinian@chromium.org
Cc: -kainino@chromium.org
Owner: kainino@chromium.org
Status: Assigned (was: Untriaged)
Labels: Test-Predator-Wrong-CLs
Status: Started (was: Assigned)
The regression range appears to be wrong due to tons of these messages:
[2018-06-15 07:07:33 UTC] clusterfuzz-linux-lt4l: Regression task in-progress: Bad build at r391531. Skipping.

Anyway, taking a look
Status: Assigned (was: Started)
Wasn't able to repro on an ASAN build at ToT (1d287ca4c7ca), un-starting until I can look at this further
unable to reproduce even with clusterfuzz reproduce 5984810875748352, on the revision it checked out for me (5d2e0567225b)
Cc: kainino@chromium.org
Owner: ----
Status: Untriaged (was: Assigned)
Project Member

Comment 9 by ClusterFuzz, Jul 22

ClusterFuzz has detected this issue as fixed in range 577077:577078.

Detailed report: https://clusterfuzz.com/testcase?key=5984810875748352

Fuzzer: inferno_twister_c
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  bool blink::WebGLRenderingContextBase::ValidateTexImageSubRectangle<blink::Image
  blink::WebGLRenderingContextBase::TexImageHelperHTMLCanvasElement
  blink::WebGL2RenderingContextBase::texSubImage3D
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=567361:567363
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=577077:577078

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5984810875748352

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Jul 22

Labels: ClusterFuzz-Verified
Status: Verified (was: Untriaged)
ClusterFuzz testcase 5984810875748352 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Mergedinto: 859623
Status: Duplicate (was: Verified)

Sign in to add a comment