New issue
Advanced search Search tips

Issue 897453 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Oct 23
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: !CheckErrorCallbackState() in gles2_cmd_decoder_passthrough.cc

Project Member Reported by ClusterFuzz, Oct 20

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4805695504121856

Fuzzer: libFuzzer_gpu_angle_passthrough_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !CheckErrorCallbackState() in gles2_cmd_decoder_passthrough.cc
  gpu::gles2::GLES2DecoderPassthroughImpl::UpdateTextureSizeFromTexturePassthrough
  gpu::gles2::GLES2DecoderPassthroughImpl::UpdateTextureSizeFromTarget
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=601152:601154

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4805695504121856

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 20

Components: Internals>GPU>Internals
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Oct 20

Cc: piman@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Oct 20

Labels: Test-Predator-Auto-Owner
Owner: geoffl...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/72fe476e7a84db7fc1a52207d2ae088e966c7aeb (Implement discardable textures in the passthrough command decoder.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 4 by bugdroid1@chromium.org, Oct 22

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/171769f64d2380be763c8ae5e9523cbb2c81f17f

commit 171769f64d2380be763c8ae5e9523cbb2c81f17f
Author: Geoff Lang <geofflang@chromium.org>
Date: Mon Oct 22 18:32:45 2018

Validate texture target before updating texture size.

The target was validated that it was one of the TextureTarget types but
not that the type was valid for the current context.  This generated GL
errors when querying the size of a 3D texture in an ES2 context.

BUG= 897453 
BUG= 892288 

Change-Id: Ia6cafaf021751876148acdaf0ee96dc51353e98a
Reviewed-on: https://chromium-review.googlesource.com/c/1293754
Reviewed-by: Antoine Labour <piman@chromium.org>
Commit-Queue: Geoff Lang <geofflang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#601663}
[modify] https://crrev.com/171769f64d2380be763c8ae5e9523cbb2c81f17f/gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc
[modify] https://crrev.com/171769f64d2380be763c8ae5e9523cbb2c81f17f/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc

Project Member

Comment 5 by ClusterFuzz, Oct 23

ClusterFuzz has detected this issue as fixed in range 601654:601667.

Detailed report: https://clusterfuzz.com/testcase?key=4805695504121856

Fuzzer: libFuzzer_gpu_angle_passthrough_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !CheckErrorCallbackState() in gles2_cmd_decoder_passthrough.cc
  gpu::gles2::GLES2DecoderPassthroughImpl::UpdateTextureSizeFromTexturePassthrough
  gpu::gles2::GLES2DecoderPassthroughImpl::UpdateTextureSizeFromTarget
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=601152:601154
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=601654:601667

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4805695504121856

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Oct 23

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4805695504121856 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment