Null-dereference READ in spvtools::opt::Instruction::HasResultId |
||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6148541010149376 Fuzzer: afl_spvtools_opt_legalization_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x00000000002d Crash State: spvtools::opt::Instruction::HasResultId spvtools::opt::analysis::DefUseManager::WhileEachUser spvtools::opt::LocalSingleBlockLoadStoreElimPass::HasOnlySupportedRefs Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=580304:580305 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6148541010149376 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Aug 10
Automatically adding ccs based on suspected regression changelists: Update OpPhi instructions after splitting block. (#1783) by 31666470+s-perron@users.noreply.github.com - https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools/+/ce644d4a2484fe66e53f5b744ebc4d0d5d49e1ca Remove using std::<foo> statements. (#1756) by dj2@everburning.com - https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools/+/a5a5ea0e2dfce9c755a88af1074ebe68a44d2ed9 If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Aug 10
cc'ing owners. Assigning to alanbaker@ because he made several recent contributions to this directory.
,
Aug 10
Note, this is not used in prod, so no need for P1.
,
Aug 13
,
Aug 13
The id bound in the spirv file is to to INT_MAX. Which means there are no new ids for the optimizer to use. The first time the optimizer asks for a new id, it gets 0. Then it asserts because it tries to use 0, which is an invalid id. There is no easy solution to this. spirv-opt is not equipped to handle this type of error. We will need to work out a design for handling this type of error.
,
Aug 13
,
Aug 14
Issue 874022 has been merged into this issue.
,
Aug 24
,
Aug 27
,
Aug 27
Issue 875797 has been merged into this issue.
,
Aug 27
Issue 876199 has been merged into this issue.
,
Aug 28
Issue 878030 has been merged into this issue.
,
Aug 29
ClusterFuzz testcase 6358639972188160 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Sep 4
,
Sep 4
,
Sep 4
I have opened https://github.com/KhronosGroup/SPIRV-Tools/issues/1841 to track this issue in github. The first PR is up for review.
,
Sep 7
Issue 880040 has been merged into this issue.
,
Sep 7
Issue 880778 has been merged into this issue.
,
Sep 7
Issue 880887 has been merged into this issue.
,
Sep 10
,
Oct 6
,
Oct 17
Issue 895231 has been merged into this issue.
,
Oct 17
Issue 895232 has been merged into this issue.
,
Nov 5
,
Nov 5
Issue 897408 has been merged into this issue.
,
Nov 5
Issue 897528 has been merged into this issue.
,
Nov 6
I just merged https://github.com/KhronosGroup/SPIRV-Tools/pull/2031 into spirv-tools. A lot of these cases will not be identified as invalid, and will no longer causes a crash. However, this issue should remain open for the cases where the id bound ends up being very close to the max id bound.
,
Nov 8
ClusterFuzz has detected this issue as fixed in range 606045:606061. Detailed report: https://clusterfuzz.com/testcase?key=6148541010149376 Fuzzer: afl_spvtools_opt_legalization_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x00000000002d Crash State: spvtools::opt::Instruction::HasResultId spvtools::opt::analysis::DefUseManager::WhileEachUser spvtools::opt::LocalSingleBlockLoadStoreElimPass::HasOnlySupportedRefs Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=580304:580305 Fixed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=606045:606061 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6148541010149376 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 14
Issue 903530 has been merged into this issue.
,
Nov 14
,
Nov 14
Issue 904090 has been merged into this issue.
,
Nov 14
,
Nov 14
Issue 904121 has been merged into this issue.
,
Nov 14
Issue 904654 has been merged into this issue.
,
Nov 19
Issue 906399 has been merged into this issue.
,
Nov 19
Issue 906423 has been merged into this issue.
,
Nov 19
Issue 906617 has been merged into this issue.
,
Nov 20
Issue 906792 has been merged into this issue.
,
Nov 26
,
Nov 26
,
Dec 3
Issue 910248 has been merged into this issue.
,
Dec 6
,
Jan 16
(6 days ago)
Issue 915002 has been merged into this issue. |
||||||||||||
►
Sign in to add a comment |
||||||||||||
Comment 1 by ClusterFuzz
, Aug 10Labels: Test-Predator-Auto-Components