New issue
Advanced search Search tips

Issue 899198 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Oct 27
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference WRITE in cc::GpuImageDecodeCache::UnrefImage

Project Member Reported by ClusterFuzz, Oct 26

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5684579971891200

Fuzzer: marty_html_twiddler
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Null-dereference WRITE
Crash Address: 0x000000000090
Crash State:
  cc::GpuImageDecodeCache::UnrefImage
  cc::ImageController::UnrefImages
  cc::TileManager::OnRasterTaskCompleted
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=602919:602946

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5684579971891200

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 26

Labels: OS-Chrome
Project Member

Comment 2 by ClusterFuzz, Oct 26

Components: Internals>Compositing
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 3 by ClusterFuzz, Oct 26

Labels: Test-Predator-Auto-Owner
Owner: khushals...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/388ab98a1a8c12d2d6bf7d7664b6e04100864b41 (cc: Avoid a decode task for bitmaps uploaded using GPU image cache.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 4 by bugdroid1@chromium.org, Oct 26

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5ad936c7291683706dc6e01841d92b502c6e1225

commit 5ad936c7291683706dc6e01841d92b502c6e1225
Author: Khushal <khushalsagar@chromium.org>
Date: Fri Oct 26 23:18:03 2018

cc: Handle canceled upload tasks for bitmaps correctly.

The decode ref is always released for an upload task, even if it is
cancelled. But the ref was being added only when the task runs in the
case of upload only tasks for bitmaps. Fix that.

R=ericrk@chromium.org

Bug: 899202, 899198 
Change-Id: I884755e6f4a7ad3bc7fcf93b762246695c732493
Reviewed-on: https://chromium-review.googlesource.com/c/1302495
Reviewed-by: Eric Karl <ericrk@chromium.org>
Commit-Queue: Khushal <khushalsagar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#603247}
[modify] https://crrev.com/5ad936c7291683706dc6e01841d92b502c6e1225/cc/tiles/gpu_image_decode_cache.cc
[modify] https://crrev.com/5ad936c7291683706dc6e01841d92b502c6e1225/cc/tiles/gpu_image_decode_cache_unittest.cc

Project Member

Comment 5 by ClusterFuzz, Oct 27

ClusterFuzz has detected this issue as fixed in range 603240:603265.

Detailed report: https://clusterfuzz.com/testcase?key=5684579971891200

Fuzzer: marty_html_twiddler
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Null-dereference WRITE
Crash Address: 0x000000000090
Crash State:
  cc::GpuImageDecodeCache::UnrefImage
  cc::ImageController::UnrefImages
  cc::TileManager::OnRasterTaskCompleted
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=602919:602946
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=603240:603265

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5684579971891200

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Oct 27

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5684579971891200 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment