Indirect-leak in dawn_native::ValidateBaseRenderPassDescriptorBuilderSetColorAttachment |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5871349895266304 Fuzzer: libFuzzer_dawn_wire_server_and_frontend_fuzzer Fuzz target binary: dawn_wire_server_and_frontend_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Indirect-leak Crash Address: Crash State: dawn_native::ValidateBaseRenderPassDescriptorBuilderSetColorAttachment dawn_native::ValidatingRenderPassDescriptorBuilderSetColorAttachment dawn_wire::server::Server::HandleRenderPassDescriptorBuilderSetColorAttachment Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=614680:614682 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5871349895266304 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Dec 13
,
Dec 17
The following revision refers to this bug: https://dawn.googlesource.com/dawn/+/0d95887dbc948adc317959efd1639520b32b9b11 commit 0d95887dbc948adc317959efd1639520b32b9b11 Author: Corentin Wallez <cwallez@chromium.org> Date: Mon Dec 17 10:55:25 2018 WireServer: don't skip destroy on error objects. An old-style builder might become an error object when a validation error occurs on one of its methods. It still has to be freed, so the correct check for "destroy" is to check that the handle is not null. BUG= chromium:914819 BUG= chromium:914867 BUG= chromium:914964 BUG= chromium:915083 Change-Id: I349faffa48f369b72c603d47dd23ffae7d86891e Reviewed-on: https://dawn-review.googlesource.com/c/3323 Reviewed-by: Stephen White <senorblanco@chromium.org> Commit-Queue: Corentin Wallez <cwallez@chromium.org> [modify] https://crrev.com/0d95887dbc948adc317959efd1639520b32b9b11/generator/templates/dawn_wire/WireServer.cpp
,
Dec 17
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/f92f50a2ff0a66c9ed32a33a8c15d135a1d0ee4d commit f92f50a2ff0a66c9ed32a33a8c15d135a1d0ee4d Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Date: Mon Dec 17 12:35:20 2018 Roll src/third_party/dawn 28c1fba1c02e..0d95887dbc94 (1 commits) https://dawn.googlesource.com/dawn.git/+log/28c1fba1c02e..0d95887dbc94 git log 28c1fba1c02e..0d95887dbc94 --date=short --no-merges --format='%ad %ae %s' 2018-12-17 cwallez@chromium.org WireServer: don't skip destroy on error objects. Created with: gclient setdep -r src/third_party/dawn@0d95887dbc94 The AutoRoll server is located here: https://autoroll.skia.org/r/dawn-chromium-autoroll Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel BUG= chromium:914819 , chromium:914867 , chromium:914964 , chromium:915083 TBR=cwallez@chromium.org Change-Id: I2f4a37c69f97833d2cb9e8a9ab67fadbb79927d2 Reviewed-on: https://chromium-review.googlesource.com/c/1379914 Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#617093} [modify] https://crrev.com/f92f50a2ff0a66c9ed32a33a8c15d135a1d0ee4d/DEPS
,
Dec 17
ClusterFuzz has detected this issue as fixed in range 617092:617093. Detailed report: https://clusterfuzz.com/testcase?key=5871349895266304 Fuzzer: libFuzzer_dawn_wire_server_and_frontend_fuzzer Fuzz target binary: dawn_wire_server_and_frontend_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Indirect-leak Crash Address: Crash State: dawn_native::ValidateBaseRenderPassDescriptorBuilderSetColorAttachment dawn_native::ValidatingRenderPassDescriptorBuilderSetColorAttachment dawn_wire::server::Server::HandleRenderPassDescriptorBuilderSetColorAttachment Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=614680:614682 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=617092:617093 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5871349895266304 See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Dec 17
ClusterFuzz testcase 5871349895266304 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by ClusterFuzz
, Dec 13Labels: ClusterFuzz-Auto-CC