encounter/dawn-cmake
1
0
Fork 0
mirror of https://github.com/encounter/dawn-cmake.git synced 2025-07-05 04:36:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

WireAndFrontendFuzzer "wait" for all commands before freeing

Browse Source 
Otherwise the Device might fire callbacks when it is destroyed,
causing use-after-frees on the wire server.

BUG=chromium:914620
BUG=chromium:914615

Change-Id: Ic47b219b4ebe2eb5abd525741c0ff1180282c87d
Reviewed-on: https://dawn-review.googlesource.com/c/3322
Reviewed-by: Stephen White <senorblanco@chromium.org>
Reviewed-by: Kai Ninomiya <kainino@chromium.org>
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
This commit is contained in:
Corentin Wallez 2018-12-15 10:34:02 +00:00 committed by Commit Bot service account
parent 48485e36a8
commit e018292bed
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/fuzzers/DawnWireServerAndFrontendFuzzer.cpp
View File

@ -53,5 +53,12 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
wireServer->HandleCommands(reinterpret_cast<const char*>(data), size); wireServer->HandleCommands(reinterpret_cast<const char*>(data), size);
// Fake waiting for all previous commands before destroying the server.
nullDevice.Tick();
// Destroy the server before the device because it needs to free all objects.
wireServer = nullptr;
nullDevice = nullptr;
return 0; return 0;
} }