New issue
Advanced search Search tips

Issue 861529 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jul 10
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: outer.Width() >= inner.Width() in graphics_context.cc

Project Member Reported by ClusterFuzz, Jul 7

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6345157574918144

Fuzzer: puzzor
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  outer.Width() >= inner.Width() in graphics_context.cc
  blink::IsSimpleDRRect
  blink::IsSimpleDRRect
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=563643:563651

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6345157574918144

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jul 7

Components: Blink>Paint
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jul 7

Labels: Test-Predator-Auto-Owner
Owner: fmalita@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/e2eef42958b177eaf8cbbdae667c481d0789421c (Revisit GraphicsContext:IsSimpleDRRect() heuristics).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 3 by bugdroid1@chromium.org, Jul 9

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/32d15eec7b971a1e975ee6fbbbffb3cc3267576c

commit 32d15eec7b971a1e975ee6fbbbffb3cc3267576c
Author: Florin Malita <fmalita@chromium.org>
Date: Mon Jul 09 22:21:27 2018

Fix assert in GraphicsContext::IsSimpleDRRect

[1] added a couple of asserts, assuming the outer/inner radii are
always following border invariants.

But the same code path is also triggered for outline painting, which
overrides some border properties to force rectangular outlines.

Also, GraphicsContext is not a good place to make outer/inner geometry
assumptions.

Remove the asserts and replace with explicit width/height checks.

[1] https://chromium.googlesource.com/chromium/src/+/e2eef42958b177eaf8cbbdae667c481d0789421c

Bug:  861529 

Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_slimming_paint_v2;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I7deb45c42f2fef8dec2caf4cc90c0b52ee1b5f51
Reviewed-on: https://chromium-review.googlesource.com/1129328
Reviewed-by: Stephen Chenney <schenney@chromium.org>
Commit-Queue: Florin Malita <fmalita@chromium.org>
Cr-Commit-Position: refs/heads/master@{#573486}
[modify] https://crrev.com/32d15eec7b971a1e975ee6fbbbffb3cc3267576c/third_party/blink/renderer/platform/graphics/graphics_context.cc

Project Member

Comment 4 by ClusterFuzz, Jul 10

ClusterFuzz has detected this issue as fixed in range 573483:573487.

Detailed report: https://clusterfuzz.com/testcase?key=6345157574918144

Fuzzer: puzzor
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  outer.Width() >= inner.Width() in graphics_context.cc
  blink::IsSimpleDRRect
  blink::IsSimpleDRRect
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=563643:563651
Fixed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=573483:573487

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6345157574918144

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Jul 10

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6345157574918144 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment