CHECK failure: 0 == memcmp(serialized2.get(), serialized3.get(), written_bytes2) in paint_op_bu |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6282178078703616 Fuzzer: libFuzzer_paint_op_buffer_eq_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: 0 == memcmp(serialized2.get(), serialized3.get(), written_bytes2) in paint_op_bu paint_op_buffer_eq_fuzzer.cc Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=578890:578891 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6282178078703616 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Aug 3
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/66bcb57a90138959ea5a42de0677ceb3cc0a40f0 (Reland "cc, gpu: Make serialization code bitness agnostic."). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Aug 3
,
Aug 7
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/68dd310ecbc1eae8a641e376584423c7720160b7 commit 68dd310ecbc1eae8a641e376584423c7720160b7 Author: Adrienne Walker <enne@chromium.org> Date: Tue Aug 07 17:22:44 2018 cc: Make paint_op_buffer_eq_fuzzer not binary compare This test case has a DrawRecord in the middle of it. There was some hope previously that because this fuzzer memset all the memory it was allocating, then all the unwritten memory could be consistent. However, because a bunch of other memory gets allocated when serializing then that memory can have garbage in the padding. When simple ops memcpy as a part of serializing or deserializing, they bring along that garbage, which can cause binary differences. This was lucky that this has ever worked on Skia serialization, so remove the binary comparison and just use the logical comparison. Bug: 870647 Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;master.tryserver.blink:linux_trusty_blink_rel Change-Id: Ie20097c4df4953bb6503caff81ad811dc69acc63 Reviewed-on: https://chromium-review.googlesource.com/1162746 Reviewed-by: Khushal <khushalsagar@chromium.org> Commit-Queue: enne <enne@chromium.org> Cr-Commit-Position: refs/heads/master@{#581265} [modify] https://crrev.com/68dd310ecbc1eae8a641e376584423c7720160b7/cc/paint/paint_op_buffer_eq_fuzzer.cc
,
Aug 8
ClusterFuzz has detected this issue as fixed in range 581262:581272. Detailed report: https://clusterfuzz.com/testcase?key=6282178078703616 Fuzzer: libFuzzer_paint_op_buffer_eq_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: 0 == memcmp(serialized2.get(), serialized3.get(), written_bytes2) in paint_op_bu paint_op_buffer_eq_fuzzer.cc Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=578890:578891 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=581262:581272 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6282178078703616 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 8
ClusterFuzz testcase 6282178078703616 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Aug 3Labels: Test-Predator-Auto-Components