New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 900058 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Nov 22
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

ASSERT: false

Project Member Reported by ClusterFuzz, Oct 30

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6030465566507008

Fuzzer: libFuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  false
  sh::TIntermConstantUnion::foldUnaryComponentWise
  sh::TIntermUnary::fold
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=528834:528837

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6030465566507008

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 30

Cc: fjhenigman@chromium.org geoffl...@chromium.org cwal...@chroimium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 2 by ClusterFuzz, Oct 30

Cc: oetu...@nvidia.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Constant fold array indexing and comparison by oetuaho@nvidia.com - https://chromium.googlesource.com/angle/angle/+/ea22b7a58bfde015d146c292a2ef65837d6e4aca

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Labels: M-71
Owner: geoffl...@chromium.org
Status: Assigned (was: Untriaged)
Predator has provided 1 possible suspect.

Suspect CL: https://chromium.googlesource.com/angle/angle/+/ea22b7a58bfde015d146c292a2ef65837d6e4aca

Since author is not chromium member, assigning it reviewer for further triage.
Cc: -cwal...@chroimium.org cwallez@chromium.org
Shader fragment that causes the assert:

struct U{void t;}n(){+U().t
Project Member

Comment 5 by bugdroid1@chromium.org, Nov 21

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/6aab06e0e5d43907861063b3a652603cdc7f986e

commit 6aab06e0e5d43907861063b3a652603cdc7f986e
Author: Geoff Lang <geofflang@chromium.org>
Date: Wed Nov 21 14:38:37 2018

Don't allow unary operators on void types.

BUG= 900058 

Change-Id: Ice8976ddd9cbc9c90162cf7fae2b8f91ddcfcef3
Reviewed-on: https://chromium-review.googlesource.com/c/1344590
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Geoff Lang <geofflang@chromium.org>

[modify] https://crrev.com/6aab06e0e5d43907861063b3a652603cdc7f986e/src/tests/compiler_tests/ConstantFolding_test.cpp
[modify] https://crrev.com/6aab06e0e5d43907861063b3a652603cdc7f986e/src/compiler/translator/ParseContext.cpp

Project Member

Comment 6 by bugdroid1@chromium.org, Nov 21

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/898332bd98de8d7493482afe3055404a62306c7e

commit 898332bd98de8d7493482afe3055404a62306c7e
Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Date: Wed Nov 21 16:04:37 2018

Roll src/third_party/angle 836674c28b1e..6aab06e0e5d4 (1 commits)

https://chromium.googlesource.com/angle/angle.git/+log/836674c28b1e..6aab06e0e5d4


git log 836674c28b1e..6aab06e0e5d4 --date=short --no-merges --format='%ad %ae %s'
2018-11-21 geofflang@chromium.org Don't allow unary operators on void types.


Created with:
  gclient setdep -r src/third_party/angle@6aab06e0e5d4

The AutoRoll server is located here: https://autoroll.skia.org/r/angle-chromium-autoroll

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel

BUG= chromium:900058 
TBR=geofflang@chromium.org

Change-Id: I2dab64c3f6dac725795455bcc04ee8fffd1f9750
Reviewed-on: https://chromium-review.googlesource.com/c/1346689
Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#610087}
[modify] https://crrev.com/898332bd98de8d7493482afe3055404a62306c7e/DEPS

Project Member

Comment 7 by ClusterFuzz, Nov 22

ClusterFuzz has detected this issue as fixed in range 610067:610087.

Detailed report: https://clusterfuzz.com/testcase?key=6030465566507008

Fuzzer: libFuzzer_angle_translator_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  false
  sh::TIntermConstantUnion::foldUnaryComponentWise
  sh::TIntermUnary::fold
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=528834:528837
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=610067:610087

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6030465566507008

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Nov 22

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6030465566507008 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment