Null-dereference WRITE in cc::GpuImageDecodeCache::UnrefImage |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5684579971891200 Fuzzer: marty_html_twiddler Job Type: mac_asan_chrome Platform Id: mac Crash Type: Null-dereference WRITE Crash Address: 0x000000000090 Crash State: cc::GpuImageDecodeCache::UnrefImage cc::ImageController::UnrefImages cc::TileManager::OnRasterTaskCompleted Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=602919:602946 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5684579971891200 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Oct 26
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
Oct 26
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/388ab98a1a8c12d2d6bf7d7664b6e04100864b41 (cc: Avoid a decode task for bitmaps uploaded using GPU image cache.). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Oct 26
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/5ad936c7291683706dc6e01841d92b502c6e1225 commit 5ad936c7291683706dc6e01841d92b502c6e1225 Author: Khushal <khushalsagar@chromium.org> Date: Fri Oct 26 23:18:03 2018 cc: Handle canceled upload tasks for bitmaps correctly. The decode ref is always released for an upload task, even if it is cancelled. But the ref was being added only when the task runs in the case of upload only tasks for bitmaps. Fix that. R=ericrk@chromium.org Bug: 899202, 899198 Change-Id: I884755e6f4a7ad3bc7fcf93b762246695c732493 Reviewed-on: https://chromium-review.googlesource.com/c/1302495 Reviewed-by: Eric Karl <ericrk@chromium.org> Commit-Queue: Khushal <khushalsagar@chromium.org> Cr-Commit-Position: refs/heads/master@{#603247} [modify] https://crrev.com/5ad936c7291683706dc6e01841d92b502c6e1225/cc/tiles/gpu_image_decode_cache.cc [modify] https://crrev.com/5ad936c7291683706dc6e01841d92b502c6e1225/cc/tiles/gpu_image_decode_cache_unittest.cc
,
Oct 27
ClusterFuzz has detected this issue as fixed in range 603240:603265. Detailed report: https://clusterfuzz.com/testcase?key=5684579971891200 Fuzzer: marty_html_twiddler Job Type: mac_asan_chrome Platform Id: mac Crash Type: Null-dereference WRITE Crash Address: 0x000000000090 Crash State: cc::GpuImageDecodeCache::UnrefImage cc::ImageController::UnrefImages cc::TileManager::OnRasterTaskCompleted Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=602919:602946 Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=603240:603265 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5684579971891200 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Oct 27
ClusterFuzz testcase 5684579971891200 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Oct 26