New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 906416 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Nov 21
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Direct-leak in GLSLFullFuzzTask

Project Member Reported by ClusterFuzz, Nov 18

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4572276642807808

Fuzzer: libFuzzer_dawn_spirv_cross_hlsl_full_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  GLSLFullFuzzTask
  int DawnSPIRVCrossFuzzer::RunWithOptions<spirv_cross::CompilerGLSL::Options>
  DawnSPIRVCrossGLSLFullFuzzer.cpp
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=608346:608347

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4572276642807808

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 18

Cc: kainino@chromium.org cwallez@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 2 by ClusterFuzz, Nov 18

Cc: rharrison@chromium.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Don't use shared libraries in the wire fuzzer. by cwallez@chromium.org - https://dawn.googlesource.com/dawn/+/2ec59d9fcc9e2dc68921cb33fdc84c51a0dac1b1

Set correct ASAN flags for SPIRV-cross fuzzers by rharrison@chromium.org - https://dawn.googlesource.com/dawn/+/499bc0318d40efa7da12dbddceccb10d289918aa

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Cc: -rharrison@chromium.org dsinclair@chromium.org fjhenigman@chromium.org
Owner: rharrison@chromium.org
Status: Assigned (was: Untriaged)
Components: Internals>GPU>Dawn
Status: Started (was: Assigned)
Project Member

Comment 5 by bugdroid1@chromium.org, Nov 19

The following revision refers to this bug:
  https://dawn.googlesource.com/dawn/+/fbeca676d409ec19572e3299288f4010c2ee8fd5

commit fbeca676d409ec19572e3299288f4010c2ee8fd5
Author: Ryan Harrison <rharrison@chromium.org>
Date: Mon Nov 19 19:20:08 2018

Tighten when signal trap is used in SPIRV-Cross fuzzers

Due the jump within the signal trap used in these fuzzers, local scope
allocations cannot occur while the signal trap is on, otherwise there
is a possibility of leaks. This CL rewrites how the code under test is
run, so that the potentially aborting code is tightly wrapped by
signal trap without any local scope allocations.

BUG= chromium:906416 

Change-Id: Ie52647433dcac57e3ea065d5bdcb6e14c5929494
Reviewed-on: https://dawn-review.googlesource.com/c/2521
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>

[modify] https://crrev.com/fbeca676d409ec19572e3299288f4010c2ee8fd5/src/fuzzers/DawnSPIRVCrossHLSLFastFuzzer.cpp
[modify] https://crrev.com/fbeca676d409ec19572e3299288f4010c2ee8fd5/src/fuzzers/DawnSPIRVCrossHLSLFullFuzzer.cpp
[modify] https://crrev.com/fbeca676d409ec19572e3299288f4010c2ee8fd5/src/fuzzers/DawnSPIRVCrossFuzzer.cpp
[modify] https://crrev.com/fbeca676d409ec19572e3299288f4010c2ee8fd5/src/fuzzers/DawnSPIRVCrossGLSLFullFuzzer.cpp
[modify] https://crrev.com/fbeca676d409ec19572e3299288f4010c2ee8fd5/src/fuzzers/DawnSPIRVCrossGLSLFastFuzzer.cpp
[modify] https://crrev.com/fbeca676d409ec19572e3299288f4010c2ee8fd5/src/fuzzers/DawnSPIRVCrossFuzzer.h
[modify] https://crrev.com/fbeca676d409ec19572e3299288f4010c2ee8fd5/src/fuzzers/DawnSPIRVCrossMSLFullFuzzer.cpp
[modify] https://crrev.com/fbeca676d409ec19572e3299288f4010c2ee8fd5/src/fuzzers/DawnSPIRVCrossMSLFastFuzzer.cpp

Status: Assigned (was: Started)
Project Member

Comment 7 by ClusterFuzz, Nov 21

ClusterFuzz has detected this issue as fixed in range 609745:609751.

Detailed report: https://clusterfuzz.com/testcase?key=4572276642807808

Fuzzer: libFuzzer_dawn_spirv_cross_hlsl_full_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  GLSLFullFuzzTask
  int DawnSPIRVCrossFuzzer::RunWithOptions<spirv_cross::CompilerGLSL::Options>
  DawnSPIRVCrossGLSLFullFuzzer.cpp
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=608346:608347
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=609745:609751

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4572276642807808

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Nov 21

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4572276642807808 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment