Float-cast-overflow in blink::SVGInlineTextBox::SelectionRectForTextFragment |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4759976556625920 Fuzzer: miaubiz_svg_fuzzer Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: blink::SVGInlineTextBox::SelectionRectForTextFragment blink::SVGInlineTextBox::LocalSelectionRect blink::LayoutSVGInlineText::LocalCaretRect Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:563900 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4759976556625920 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Sep 6
Automatically adding ccs based on suspected regression changelists: Introduce TextSegments class with Finder interface by yosin@chromium.org - https://chromium.googlesource.com/chromium/src/+/6ea45774b43642488abee6688f0ac328903c2400 Make EndOfSentence() to utilize TextOffsetMapping by yosin@chromium.org - https://chromium.googlesource.com/chromium/src/+/6535528f00c742b6cb9dcce8e46567048ac0dadc If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Sep 6
Regression range is useless. This one is non-obvious, because I can see nothing in the test case that would get us a text height after zoom of 10e18. Might be a real bug.
,
Sep 6
Taking a look.
,
Sep 6
I guess this could be be the skewY(90) (after some rounding et.c) yielding a value like that.
,
Sep 6
Indeed, I should have noticed the skew. Seems like we should push skews of 90 away from 90.
,
Sep 6
I think we are in actuality already (due to precision issues.) I'm making a simpler fix for this though (https://chromium-review.googlesource.com/c/chromium/src/+/1209923)
,
Sep 7
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/579904687f1f55217f681c48248f007356fb55e7 commit 579904687f1f55217f681c48248f007356fb55e7 Author: Fredrik Söderquist <fs@opera.com> Date: Fri Sep 07 09:18:38 2018 Pass a float height to Font::SelectionRectForText Rather than converting an int argument to a float in the function (that return a FloatRect), pass a float argument and let the caller handle a conversion (if needed.) Bug: 881188 Change-Id: If3083fc19c866f003b0d60e10246b3088463dcdd Reviewed-on: https://chromium-review.googlesource.com/1209923 Reviewed-by: Dominik Röttsches <drott@chromium.org> Commit-Queue: Fredrik Söderquist <fs@opera.com> Cr-Commit-Position: refs/heads/master@{#589471} [modify] https://crrev.com/579904687f1f55217f681c48248f007356fb55e7/third_party/WebKit/LayoutTests/platform/mac/svg/text/text-selection-align-01-b-expected.png [modify] https://crrev.com/579904687f1f55217f681c48248f007356fb55e7/third_party/WebKit/LayoutTests/platform/mac/svg/text/text-selection-align-02-b-expected.png [modify] https://crrev.com/579904687f1f55217f681c48248f007356fb55e7/third_party/WebKit/LayoutTests/platform/win/svg/text/text-selection-fonts-02-t-expected.png [modify] https://crrev.com/579904687f1f55217f681c48248f007356fb55e7/third_party/blink/renderer/platform/fonts/font.cc [modify] https://crrev.com/579904687f1f55217f681c48248f007356fb55e7/third_party/blink/renderer/platform/fonts/font.h
,
Sep 8
ClusterFuzz has detected this issue as fixed in range 589470:589471. Detailed report: https://clusterfuzz.com/testcase?key=4759976556625920 Fuzzer: miaubiz_svg_fuzzer Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: blink::SVGInlineTextBox::SelectionRectForTextFragment blink::SVGInlineTextBox::LocalSelectionRect blink::LayoutSVGInlineText::LocalCaretRect Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:563900 Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=589470:589471 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4759976556625920 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 8
ClusterFuzz testcase 4759976556625920 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Sep 6Labels: Test-Predator-Auto-Components