New issue
Advanced search Search tips

Issue 899507 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 17
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Float-cast-overflow in blink::AudioParamTimeline::ProcessLinearRamp

Project Member Reported by ClusterFuzz, Oct 27

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5149259475976192

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::AudioParamTimeline::ProcessLinearRamp
  blink::AudioParamTimeline::ValuesForFrameRangeImpl
  blink::AudioParamTimeline::ValuesForFrameRange
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:563900

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5149259475976192

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 27

Components: Blink>WebAudio
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: kkaluri@chromium.org hongchan@chromium.org
Labels: M-71
Owner: rtoy@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.

Using Code Search for the file, "audio_param_timeline.cc" suspecting the below Cl might have caused this issue

Suspect CL: https://chromium.googlesource.com/chromium/src/+/7e8253c958ca8f5105d09468a45155ee8a3053c7

rtoy@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!
Project Member

Comment 3 by bugdroid1@chromium.org, Jan 16 (6 days ago)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4fec59b303a6a3848739c32308718dcf3dfe149b

commit 4fec59b303a6a3848739c32308718dcf3dfe149b
Author: Raymond Toy <rtoy@chromium.org>
Date: Wed Jan 16 22:18:59 2019

Don't overflow when event times are very close in time

If a linear ramp starts very close to 0, the computation of the output
can sometimes overflow and produce NaN.  Clamp the time difference so
thia doesn't happen and internally treat it as if the difference were
zero.

Add test that NaN doesn't occur and also verify that the clamping
doesn't change existing interpolation.

Bug:  899507 
Test: the-audioparam-interface/audioparam-close.html
Change-Id: Ic91cec577fdb4e0774d51fff66da2947baa98263
Reviewed-on: https://chromium-review.googlesource.com/c/1411651
Commit-Queue: Raymond Toy <rtoy@chromium.org>
Reviewed-by: Hongchan Choi <hongchan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#623394}
[modify] https://crrev.com/4fec59b303a6a3848739c32308718dcf3dfe149b/third_party/blink/renderer/modules/webaudio/audio_param_timeline.cc
[add] https://crrev.com/4fec59b303a6a3848739c32308718dcf3dfe149b/third_party/blink/web_tests/external/wpt/webaudio/the-audio-api/the-audioparam-interface/audioparam-close.html

Project Member

Comment 4 by ClusterFuzz, Jan 17 (5 days ago)

ClusterFuzz has detected this issue as fixed in range 623393:623396.

Detailed report: https://clusterfuzz.com/testcase?key=5149259475976192

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::AudioParamTimeline::ProcessLinearRamp
  blink::AudioParamTimeline::ValuesForFrameRangeImpl
  blink::AudioParamTimeline::ValuesForFrameRange
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:563900
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=623393:623396

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5149259475976192

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Jan 17 (5 days ago)

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5149259475976192 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment