Null-dereference WRITE in dawn_native::CommandAllocator::Allocate |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6328826424197120 Fuzzer: afl_dawn_wire_server_and_frontend_fuzzer Fuzz target binary: dawn_wire_server_and_frontend_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: Null-dereference WRITE Crash Address: 0x000000000000 Crash State: dawn_native::CommandAllocator::Allocate dawn_native::ComputePassEncoderBase::Dispatch dawn_wire::server::Server::HandleComputePassEncoderDispatch Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=614680:614682 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6328826424197120 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Dec 13
Automatically assigning owner based on suspected regression changelist https://dawn.googlesource.com/dawn/+/6f0e1f9d8235842e3c1130e4133e92e850166584 (Remove BufferView and inline offset/size in BindGroup). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Dec 14
,
Dec 15
The following revision refers to this bug: https://dawn.googlesource.com/dawn/+/28c1fba1c02eb0c8fedb9794645e4a2dc06d1904 commit 28c1fba1c02eb0c8fedb9794645e4a2dc06d1904 Author: Corentin Wallez <cwallez@chromium.org> Date: Sat Dec 15 10:34:42 2018 Validate CommmandBuffers aren't ended mid pass. Also adds regression tests. BUG= chromium:914566 BUG= chromium:914641 Change-Id: Ic1f9f2440580c3598831c8b2d1310e81aa944133 Reviewed-on: https://dawn-review.googlesource.com/c/3321 Reviewed-by: Austin Eng <enga@chromium.org> Reviewed-by: Kai Ninomiya <kainino@chromium.org> Commit-Queue: Corentin Wallez <cwallez@chromium.org> [modify] https://crrev.com/28c1fba1c02eb0c8fedb9794645e4a2dc06d1904/src/tests/unittests/validation/CommandBufferValidationTests.cpp [modify] https://crrev.com/28c1fba1c02eb0c8fedb9794645e4a2dc06d1904/src/dawn_native/CommandBuffer.cpp
,
Dec 15
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/83210270d62def978519e834576bd10dd227da6d commit 83210270d62def978519e834576bd10dd227da6d Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Date: Sat Dec 15 17:36:23 2018 Roll src/third_party/dawn e018292bed9c..28c1fba1c02e (1 commits) https://dawn.googlesource.com/dawn.git/+log/e018292bed9c..28c1fba1c02e git log e018292bed9c..28c1fba1c02e --date=short --no-merges --format='%ad %ae %s' 2018-12-15 cwallez@chromium.org Validate CommmandBuffers aren't ended mid pass. Created with: gclient setdep -r src/third_party/dawn@28c1fba1c02e The AutoRoll server is located here: https://autoroll.skia.org/r/dawn-chromium-autoroll Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel BUG= chromium:914566 , chromium:914641 TBR=cwallez@chromium.org Change-Id: I24d5b0e1608bb4bcdb9252dcf86c4bce87aaba37 Reviewed-on: https://chromium-review.googlesource.com/c/1379339 Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#616985} [modify] https://crrev.com/83210270d62def978519e834576bd10dd227da6d/DEPS
,
Dec 16
ClusterFuzz has detected this issue as fixed in range 616984:616985. Detailed report: https://clusterfuzz.com/testcase?key=6328826424197120 Fuzzer: afl_dawn_wire_server_and_frontend_fuzzer Fuzz target binary: dawn_wire_server_and_frontend_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: Null-dereference WRITE Crash Address: 0x000000000000 Crash State: dawn_native::CommandAllocator::Allocate dawn_native::ComputePassEncoderBase::Dispatch dawn_wire::server::Server::HandleComputePassEncoderDispatch Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=614680:614682 Fixed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=616984:616985 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6328826424197120 See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Dec 16
ClusterFuzz testcase 6328826424197120 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Dec 13Labels: ClusterFuzz-Auto-CC