New issue
Advanced search Search tips

Issue 875547 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Oct 3
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Timeout in spvtools_opt_size_fuzzer

Project Member Reported by ClusterFuzz, Aug 18

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5575026242486272

Fuzzer: libFuzzer_spvtools_opt_size_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  spvtools_opt_size_fuzzer
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=583284:583299

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5575026242486272

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Cc: kkaluri@chromium.org
Labels: M-70 CF-NeedsTriage Test-Predator-Wrong
Unable to find actual suspect through code search and also observing no CL's under regression range, hence adding appropriate label and requesting someone from dev team to look in to this issue.

Thanks!
Cc: dsinclair@chromium.org
Components: Internals>GPU>Internals
Labels: -M-70
Owner: stevenperron@google.com
Status: Assigned (was: Untriaged)
This test case has 2492 OpExtension instructions.  These instructions each have a string that is passed to GetExtensionFromString to find information about the actual extension.

That function does a binary search doing a string compare at every step in order to find the extension the given string corresponds to.  All of these string comparisons are noticeable.

This could be implemented as a different data structure to improve the time, but because this part of the code relies on static tables and they are auto generated, it would require some design work.

When I run this myself, it take no where near 25secs.

Given that this is just taking a long time (no an infinite loop), and it is behaving as expected, I think this should be lower priority issue, if it gets fixed at all.
On further investigation, the search is not the slow part.  It was disassembling the instructions when outputing a message.  The messages in the validator have a number of problems.

I believe https://github.com/KhronosGroup/SPIRV-Tools/pull/1951 will fix this bug, and the other issue will be handled in https://github.com/KhronosGroup/SPIRV-Tools/pull/1950.
Cc: stevenperron@google.com
 Issue 887796  has been merged into this issue.
Status: Fixed (was: Assigned)
Project Member

Comment 7 by ClusterFuzz, Oct 4

ClusterFuzz has detected this issue as fixed in range 596377:596390.

Detailed report: https://clusterfuzz.com/testcase?key=5575026242486272

Fuzzer: libFuzzer_spvtools_opt_size_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  spvtools_opt_size_fuzzer
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=583284:583299
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=596377:596390

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5575026242486272

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Oct 4

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 4551744317816832 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment