Float-cast-overflow in blink::AudioParamTimeline::ProcessLinearRamp |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5149259475976192 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: blink::AudioParamTimeline::ProcessLinearRamp blink::AudioParamTimeline::ValuesForFrameRangeImpl blink::AudioParamTimeline::ValuesForFrameRange Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:563900 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5149259475976192 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Oct 29
Predator and CL could not provide any possible suspects. Using Code Search for the file, "audio_param_timeline.cc" suspecting the below Cl might have caused this issue Suspect CL: https://chromium.googlesource.com/chromium/src/+/7e8253c958ca8f5105d09468a45155ee8a3053c7 rtoy@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner. Thanks!
,
Jan 16
(6 days ago)
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/4fec59b303a6a3848739c32308718dcf3dfe149b commit 4fec59b303a6a3848739c32308718dcf3dfe149b Author: Raymond Toy <rtoy@chromium.org> Date: Wed Jan 16 22:18:59 2019 Don't overflow when event times are very close in time If a linear ramp starts very close to 0, the computation of the output can sometimes overflow and produce NaN. Clamp the time difference so thia doesn't happen and internally treat it as if the difference were zero. Add test that NaN doesn't occur and also verify that the clamping doesn't change existing interpolation. Bug: 899507 Test: the-audioparam-interface/audioparam-close.html Change-Id: Ic91cec577fdb4e0774d51fff66da2947baa98263 Reviewed-on: https://chromium-review.googlesource.com/c/1411651 Commit-Queue: Raymond Toy <rtoy@chromium.org> Reviewed-by: Hongchan Choi <hongchan@chromium.org> Cr-Commit-Position: refs/heads/master@{#623394} [modify] https://crrev.com/4fec59b303a6a3848739c32308718dcf3dfe149b/third_party/blink/renderer/modules/webaudio/audio_param_timeline.cc [add] https://crrev.com/4fec59b303a6a3848739c32308718dcf3dfe149b/third_party/blink/web_tests/external/wpt/webaudio/the-audio-api/the-audioparam-interface/audioparam-close.html
,
Jan 17
(5 days ago)
ClusterFuzz has detected this issue as fixed in range 623393:623396. Detailed report: https://clusterfuzz.com/testcase?key=5149259475976192 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: blink::AudioParamTimeline::ProcessLinearRamp blink::AudioParamTimeline::ValuesForFrameRangeImpl blink::AudioParamTimeline::ValuesForFrameRange Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:563900 Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=623393:623396 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5149259475976192 See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jan 17
(5 days ago)
ClusterFuzz testcase 5149259475976192 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by ClusterFuzz
, Oct 27Labels: Test-Predator-Auto-Components