Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.

Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/68aee0b4d287205ca6c43ec7629ed0b83d714160 (Remove function no longer called anywhere).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

This is because we are dereferencing a nullptr in third_party/swiftshader

https://cs.chromium.org/chromium/src/third_party/swiftshader/src/OpenGL/libGLESv2/Context.cpp?rcl=659d89e94bf94240805b1d075017e43e8b388095&l=2324

This is because there was no glBindBuffer(GL_UNIFORM_BUFFER, ...) call.

I'm not sure what the right solution is here: whether to validate in GLES2Decoder (easy to do because we already have ContextState::bound_uniform_buffer) or inside of SwiftShader (treat this a driver bug).

@piman: What's your preference?

It is a swiftshader bug (implementation is required to return 0 in that case, per spec).

The following revision refers to this bug:
  https://swiftshader.googlesource.com/SwiftShader.git/+/b7334daedbfb966b29786467cc74ff771baac727

commit b7334daedbfb966b29786467cc74ff771baac727
Author: Nicolas Capens <capn@google.com>
Date: Wed Jul 04 17:48:17 2018

Remove invalid glGetIntegerv() enums.

GL_UNIFORM_BUFFER_SIZE and GL_UNIFORM_BUFFER_START can't be queried
using glGetIntegerv(). They're only valid for glGetInteger64i_v().

This prevents a potential null dereference.

 Bug chromium:859775 

Change-Id: Ic66f33a582805b021a2d4bd08ff627f704d42aa7
Reviewed-on: https://swiftshader-review.googlesource.com/19748
Tested-by: Nicolas Capens <nicolascapens@google.com>
Reviewed-by: Alexis Hétu <sugoi@google.com>

[modify] https://crrev.com/b7334daedbfb966b29786467cc74ff771baac727/src/OpenGL/libGLESv2/Context.cpp

ClusterFuzz has detected this issue as fixed in range 572608:573019.

Detailed report: https://clusterfuzz.com/testcase?key=4513475288891392

Fuzzer: libFuzzer_gpu_swiftshader_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000018
Crash State:
  bool es2::Context::getIntegerv<int>
  es2::GetIntegerv
  gpu::gles2::GLES2DecoderImpl::GetHelper
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=518239:518261
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=572608:573019

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4513475288891392

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4513475288891392 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.