New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 890581 link

Starred by 3 users

Issue metadata

Status: Verified
Owner:
Email to this user bounced
Closed: Oct 6
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

ASSERT: resultIndex == resultSize

Project Member Reported by ClusterFuzz, Sep 29

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6326816695123968

Fuzzer: libFuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  resultIndex == resultSize
  sh::TIntermAggregate::getConstantValue
  sh::TIntermBinary::fold
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=528834:528837

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6326816695123968

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Sep 29

Cc: cwal...@chroimium.org geoffl...@chromium.org fjhenigman@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 2 by ClusterFuzz, Sep 29

Labels: Test-Predator-Auto-Owner
Owner: oetu...@nvidia.com
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/angle/angle/+/ea22b7a58bfde015d146c292a2ef65837d6e4aca (Constant fold array indexing and comparison).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 3 by bugdroid1@chromium.org, Oct 5

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/5476e805a321d786f8b6a003ab95b1bee0c30964

commit 5476e805a321d786f8b6a003ab95b1bee0c30964
Author: Olli Etuaho <oetuaho@nvidia.com>
Date: Fri Oct 05 12:14:45 2018

Fix constructing void array zero nodes

Correctly sized void arrays can be needed after parsing has recovered
from an error and the code is trying to evaluate the constant value of
a node. Since now we just have a generic EOpConstruct op instead of
different ops for different types, we can simply remove the special
handling for void arrays in CreateZeroNode to create the arrays in the
correct size.

BUG= chromium:890581 
TEST=angle_unittests

Change-Id: I48d96c9ef1d695cd8583a845fd4bd24a7aaf535c
Reviewed-on: https://chromium-review.googlesource.com/c/1264515
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Commit-Queue: Olli Etuaho <oetuaho@nvidia.com>

[modify] https://crrev.com/5476e805a321d786f8b6a003ab95b1bee0c30964/src/compiler/translator/tree_util/IntermNode_util.cpp
[modify] https://crrev.com/5476e805a321d786f8b6a003ab95b1bee0c30964/src/tests/compiler_tests/ShaderValidation_test.cpp

Project Member

Comment 4 by bugdroid1@chromium.org, Oct 5

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ab036811c834b599217884df22e8822f011141aa

commit ab036811c834b599217884df22e8822f011141aa
Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Date: Fri Oct 05 14:52:47 2018

Roll src/third_party/angle 2343836c4210..5476e805a321 (1 commits)

https://chromium.googlesource.com/angle/angle.git/+log/2343836c4210..5476e805a321


git log 2343836c4210..5476e805a321 --date=short --no-merges --format='%ad %ae %s'
2018-10-05 oetuaho@nvidia.com Fix constructing void array zero nodes


Created with:
  gclient setdep -r src/third_party/angle@5476e805a321

The AutoRoll server is located here: https://autoroll.skia.org/r/angle-chromium-autoroll

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel

BUG= chromium:890581 
TBR=cwallez@chromium.org

Change-Id: Id38bb6fa5c1d4bab11e459f18508e793b765be1c
Reviewed-on: https://chromium-review.googlesource.com/c/1264627
Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#597118}
[modify] https://crrev.com/ab036811c834b599217884df22e8822f011141aa/DEPS

Project Member

Comment 5 by ClusterFuzz, Oct 6

ClusterFuzz has detected this issue as fixed in range 597116:597118.

Detailed report: https://clusterfuzz.com/testcase?key=6326816695123968

Fuzzer: libFuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  resultIndex == resultSize
  sh::TIntermAggregate::getConstantValue
  sh::TIntermBinary::fold
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=528834:528837
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=597116:597118

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6326816695123968

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Oct 6

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6326816695123968 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment