Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

senorblanco: Is it possible for https://chromium.googlesource.com/chromium/src/+/df18b96b443774d232e39ead6cbd81c848b8563c to have triggered this? I can't tell if it's an issue in Apple's OpenGL or the calling code.

A bit more of the stack:
   #0 0x7fff89370e6c in glvmRasterOpRead
     #1 0x7fff8936b145 in glvmInterpretFPTransformFour
     #2 0x7fff8a15f3d7 in gldLLVMFPTransform
    #3 0x7fff8a173ad4 in gldLLVMVecPolyRender
    #4 0x7fff8a1594ec in gldRenderFillPolygonPtr
    #5 0x1369fed2f  (<unknown module>)
    #5 0x7fff87912331 in gleFlushAtomicFunc
    #6 0x7fff879a37b5 in glDrawArrays_GL3Exec

This is in Apples software renderer IIUC (gldLLVM is "gl driver llvm"). So this is an Apple bug.

Out of interest, when does the Apple software renderer get used? I thought Macs were always either accelerated or blacklisted (no GL).

I should emphasize the IIUC part of #5, but we use Apple's SW renderer in VMWare at times.

senorblanco: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Given that it's a bug in the Apple software renderer, I don't think there's much I can do. I have had no reports of instability on real GPUs from this change.

If no GPU is available (e.g., VMWare) we should really be using the Skia software renderer and software compositor for 2D content, not GL with the Apple software renderer. It would likely be much faster, as well.

ClusterFuzz testcase 5735040506658816 is still reproducing on tip-of-tree build (trunk).

If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase.

Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot