New issue
Advanced search Search tips

Issue 870647 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Aug 8
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: 0 == memcmp(serialized2.get(), serialized3.get(), written_bytes2) in paint_op_bu

Project Member Reported by ClusterFuzz, Aug 3

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6282178078703616

Fuzzer: libFuzzer_paint_op_buffer_eq_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  0 == memcmp(serialized2.get(), serialized3.get(), written_bytes2) in paint_op_bu
  paint_op_buffer_eq_fuzzer.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=578890:578891

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6282178078703616

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Aug 3

Components: Internals>Compositing
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Aug 3

Labels: Test-Predator-Auto-Owner
Owner: p...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/66bcb57a90138959ea5a42de0677ceb3cc0a40f0 (Reland "cc, gpu: Make serialization code bitness agnostic.").

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Cc: p...@chromium.org
Owner: enne@chromium.org
Project Member

Comment 4 by bugdroid1@chromium.org, Aug 7

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/68dd310ecbc1eae8a641e376584423c7720160b7

commit 68dd310ecbc1eae8a641e376584423c7720160b7
Author: Adrienne Walker <enne@chromium.org>
Date: Tue Aug 07 17:22:44 2018

cc: Make paint_op_buffer_eq_fuzzer not binary compare

This test case has a DrawRecord in the middle of it.  There was some
hope previously that because this fuzzer memset all the memory it
was allocating, then all the unwritten memory could be consistent.
However, because a bunch of other memory gets allocated when serializing
then that memory can have garbage in the padding.  When simple ops
memcpy as a part of serializing or deserializing, they bring along
that garbage, which can cause binary differences.

This was lucky that this has ever worked on Skia serialization, so
remove the binary comparison and just use the logical comparison.

Bug:  870647 
Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ie20097c4df4953bb6503caff81ad811dc69acc63
Reviewed-on: https://chromium-review.googlesource.com/1162746
Reviewed-by: Khushal <khushalsagar@chromium.org>
Commit-Queue: enne <enne@chromium.org>
Cr-Commit-Position: refs/heads/master@{#581265}
[modify] https://crrev.com/68dd310ecbc1eae8a641e376584423c7720160b7/cc/paint/paint_op_buffer_eq_fuzzer.cc

Project Member

Comment 5 by ClusterFuzz, Aug 8

ClusterFuzz has detected this issue as fixed in range 581262:581272.

Detailed report: https://clusterfuzz.com/testcase?key=6282178078703616

Fuzzer: libFuzzer_paint_op_buffer_eq_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  0 == memcmp(serialized2.get(), serialized3.get(), written_bytes2) in paint_op_bu
  paint_op_buffer_eq_fuzzer.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=578890:578891
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=581262:581272

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6282178078703616

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Aug 8

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6282178078703616 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment