Null-dereference READ in gl::GLFence::IsSupported |
||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5174775275847680 Fuzzer: phoglund_webrtc_peerconnection Job Type: windows_asan_chrome_no_sandbox Platform Id: windows Crash Type: Null-dereference READ Crash Address: 0x000000000e66 Crash State: gl::GLFence::IsSupported gpu::gles2::FeatureInfo::InitializeFeatures gpu::gles2::ContextGroup::Initialize Sanitizer: address (ASAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5174775275847680 Additional requirements: Requires HTTP Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Nov 9
Predator and CL could not provide any possible suspects. Using Code Search for the file, "gl_fence.cc" suspecting the below Cl might have caused this issue Suspect CL: https://chromium.googlesource.com/chromium/src/+/3821fdf5c54add24d02adef248a311c293ea0bd0 sadrul@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner. Thanks!
,
Nov 9
The logs contain the following before the null-read: ... [4844:1016:1109/001040.262:ERROR:angle_platform_impl.cc(47)] reset(614): Could not create additional swap chains or offscreen surfaces, HRESULT: 0x887A0022 [4844:1016:1109/001040.263:ERROR:gl_surface_egl.cc(537)] EGL Driver message (Critical) eglCreateWindowSurface: Context lost. [4844:1016:1109/001040.264:ERROR:gl_surface_egl.cc(1057)] eglCreateWindowSurface failed with error EGL_CONTEXT_LOST [4844:1016:1109/001040.264:ERROR:gles2_command_buffer_stub.cc(237)] ContextResult::kSurfaceFailure: Failed to create surface. [4844:1016:1109/001040.270:ERROR:gl_surface_egl.cc(537)] EGL Driver message (Critical) eglMakeCurrent: Context lost. [496:5056:1109/001040.272:ERROR:gpu_process_transport_factory.cc(963)] Lost UI shared context. [4844:1016:1109/001040.549:ERROR:gl_bindings_autogen_gl.cc(13953)] Trying to call glGetIntegerv without current GL context [4844:1016:1109/001040.549:ERROR:gl_bindings_autogen_gl.cc(13953)] Trying to call glGetString without current GL context [4844:1016:1109/001040.550:ERROR:gl_bindings_autogen_gl.cc(13953)] Trying to call glGetString without current GL context [4844:1016:1109/001040.550:ERROR:gl_bindings_autogen_gl.cc(13953)] Trying to call glGetString without current GL context [4844:1016:1109/001040.550:ERROR:gl_bindings_autogen_gl.cc(13953)] Trying to call glGetString without current GL context ================================================================= ==4844==ERROR: AddressSanitizer: access-violation on unknown address 0x000000000e66 (pc 0x7fff0381a84c bp 0x00507f5f7e60 sp 0x00507f5f62e0 T0) ... Perhaps angle related?
,
Nov 9
Looks like a dupe of issue 897076 Assigning to Mo in case this is something new.
,
Nov 9
Yes, this is a dupe of crbug.com/897076 , but since I closed that already, let's not dupe because there is an action we need to take. I expect similar things will surface and disappear until we pass in --use-gl=swiftshader to this fuzzer. phoglund@: can you do that? since you are the owner of this fuzzer
,
Nov 9
,
Nov 12
Sure.
,
Nov 13
,
Nov 19
The following revision refers to this bug: https://chrome-internal.googlesource.com/chrome/webrtc-internal/webrtc-signal/+/425000b5508e643e951f5c4772cfc1f47581db48 commit 425000b5508e643e951f5c4772cfc1f47581db48 Author: Patrik Höglund <phoglund@chromium.org> Date: Mon Nov 19 09:25:33 2018
,
Nov 27
Friendly ping for an update on this.
,
Nov 27
Now we run this fuzzer with SwiftShader, the issue should be fixed. phoglund@: thanks.
,
Nov 28
Right, I forgot to mark the bug fixed. The fuzzer is deployed since a couple weeks back so we should be good.
,
Dec 1
ClusterFuzz testcase 5174775275847680 appears to be flaky, updating reproducibility label.
,
Dec 1
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label. |
||||||||||
►
Sign in to add a comment |
||||||||||
Comment 1 by ClusterFuzz
, Nov 8