Null-dereference READ in dawn_native::Ref<dawn_native::TextureBase>::Get |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6247357810999296 Fuzzer: libFuzzer_dawn_wire_server_and_frontend_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000018 Crash State: dawn_native::Ref<dawn_native::TextureBase>::Get dawn_native::TextureViewBase::GetTexture dawn_native::RenderPassDescriptorBuilder::SetDepthStencilAttachment Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=607416:607428 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6247357810999296 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Nov 14
,
Nov 19
,
Nov 28
ClusterFuzz has detected this issue as fixed in range 611548:611551. Detailed report: https://clusterfuzz.com/testcase?key=6247357810999296 Fuzzer: libFuzzer_dawn_wire_server_and_frontend_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000018 Crash State: dawn_native::Ref<dawn_native::TextureBase>::Get dawn_native::TextureViewBase::GetTexture dawn_native::RenderPassDescriptorBuilder::SetDepthStencilAttachment Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=607416:607428 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=611548:611551 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6247357810999296 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 28
ClusterFuzz testcase 6247357810999296 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Nov 28
The following revision refers to this bug: https://dawn.googlesource.com/dawn/+/d8c1a48fc4663c92690f2649a7eee01b549d6fc9 commit d8c1a48fc4663c92690f2649a7eee01b549d6fc9 Author: Corentin Wallez <cwallez@chromium.org> Date: Wed Nov 28 17:00:33 2018 WireCmd: require opt-in to treat ID 0 as nullptr instead of error. In preparation for the descriptorization of BindGroup, support was added to treat wire ID 0 as nullptr for a bunch of objects. Now that we have a fuzzer for the wire+frontend, we need to validate when we have a 0 id. Either the wire needs to reject the ID or the frontend needs to validate against nullptrs. Since only few entrypoints will have a use for nullptrs (bind groups, render pass resolve textures), we require an opt-in in the JSON file for a structure member or an argument to be optional. This disables the tests related to ID 0 = nullptr, because we don't yet have optional argument/members in dawn.json. BUG= chromium:905273 BUG= chromium:906418 BUG= chromium:908678 Change-Id: If9a3c4857db43ca26a90abff2437e1cebb0ab79b Reviewed-on: https://dawn-review.googlesource.com/c/2704 Reviewed-by: Kai Ninomiya <kainino@chromium.org> Reviewed-by: Stephen White <senorblanco@chromium.org> Reviewed-by: Corentin Wallez <cwallez@chromium.org> Commit-Queue: Corentin Wallez <cwallez@chromium.org> [modify] https://crrev.com/d8c1a48fc4663c92690f2649a7eee01b549d6fc9/generator/main.py [modify] https://crrev.com/d8c1a48fc4663c92690f2649a7eee01b549d6fc9/generator/templates/dawn_wire/WireServer.cpp [modify] https://crrev.com/d8c1a48fc4663c92690f2649a7eee01b549d6fc9/generator/templates/dawn_wire/WireClient.cpp [modify] https://crrev.com/d8c1a48fc4663c92690f2649a7eee01b549d6fc9/generator/templates/dawn_wire/WireCmd.cpp [modify] https://crrev.com/d8c1a48fc4663c92690f2649a7eee01b549d6fc9/generator/templates/dawn_wire/WireCmd.h [modify] https://crrev.com/d8c1a48fc4663c92690f2649a7eee01b549d6fc9/src/tests/unittests/WireTests.cpp
,
Nov 28
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/9be2595aa9057fdfffd1fea251d7ab132ac510aa commit 9be2595aa9057fdfffd1fea251d7ab132ac510aa Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Date: Wed Nov 28 22:42:57 2018 Roll src/third_party/dawn 596d6fe00db7..ac71e34d4ad1 (4 commits) https://dawn.googlesource.com/dawn.git/+log/596d6fe00db7..ac71e34d4ad1 git log 596d6fe00db7..ac71e34d4ad1 --date=short --no-merges --format='%ad %ae %s' 2018-11-28 brandon1.jones@intel.com Change Copy Operation Interfaces to Match WebGPU IDL 2018-11-28 enga@chromium.org Factor SerialQueue into SerialQueue and SerialMap 2018-11-28 cwallez@chromium.org WireCmd: require opt-in to treat ID 0 as nullptr instead of error. 2018-11-28 cwallez@chromium.org Roll SPIRV-Tools and temporarily use Vulkan SPIRV validation Created with: gclient setdep -r src/third_party/dawn@ac71e34d4ad1 The AutoRoll server is located here: https://autoroll.skia.org/r/dawn-chromium-autoroll Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel BUG= chromium:905273 , chromium:906418 , chromium:908678 TBR=cwallez@chromium.org Change-Id: I4979c5123a026fa468c660f45dce4fcf4f1903ae Reviewed-on: https://chromium-review.googlesource.com/c/1354240 Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#611909} [modify] https://crrev.com/9be2595aa9057fdfffd1fea251d7ab132ac510aa/DEPS |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Nov 14Labels: ClusterFuzz-Auto-CC