Float-cast-overflow in blink::IIRFilter::Process |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6543867439218688 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: blink::IIRFilter::Process blink::IIRProcessor::Process blink::AudioHandler::ProcessIfNecessary Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:563900 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6543867439218688 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Sep 15
Automatically adding ccs based on suspected regression changelists: Fix Pi-related constants for Chromium C++ style. by tkent@chromium.org - https://chromium.googlesource.com/chromium/src/+/68b36958a5252b72df14ef11646554c5d6760cb3 Bypass tail time computation if IIR filter is unstable by rtoy@chromium.org - https://chromium.googlesource.com/chromium/src/+/949538bb77dce13f23abe328338f50f39c6350e0 If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Sep 17
tkent@/rtoy@ : Could you please look into this issue.
,
Sep 18
The offending line is dest_p[n] = yn I'm guessing yn is a double-float infinity value. However dest_p[n] is a float. If so, why is casting a double-float infinity to single an undefined behavior?
,
Sep 18
Oh, the filter is unstable, so it's natural for the impulse response go off to infinity.
,
Sep 18
WontFix (WAI). The IEEE754-2008 spec (5.4.2) is pretty clear that when converting from one format to a narrower format, the result is rounded according to Clause 4, which states that if the number is too large for the target format, it is converted to infinity (in round to nearest mode).
,
Sep 25
ClusterFuzz testcase 6543867439218688 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
,
Sep 27
+inferno As mentioned above, we're converting a double float infinity value to a single float infinity value. IEEE says this is well-defined. But should we add, say, an explicit static_cast or something? |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Sep 15Labels: Test-Predator-Auto-Components