New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 591295 link

Starred by 0 users
Status: Verified
Owner:
tfarina@chromium.org
Closed: Jun 2016
Cc:
█ ranjitkan@chromium.org
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Regression



Sign in to add a comment

Crash in blink::WebRange::startOffset

Project Member Reported by ClusterFuzz, Mar 2 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4723230192959488

Fuzzer: mbarbella_js_mutation_layout
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  base::internal::Invoker<base::IndexSequence<>,base::internal::BindState<base::in
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=378152:378159

Minimized Testcase (0.07 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97IG4q-ffv0VjWhOrg_IhQqWd_WC8MZJ5WreyVqRnyHpGT8Z2cUJmIVDh0I2wK3f2HmJjAAOj_eHNo08W4QfMDS8B9OS0AwqfH9E6Q83WGdivZ9Und7MZR9NIp0MQAPMtV4eunbPTDi8bLF1E-yrZVw4fLwLw
<script>
"hello", 5;
textInputController.markedRange();
  </script>


Filer: ranjitkan

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by ranjitkan@chromium.org, Mar 2 2016

Cc: ranjitkan@chromium.org
Labels: -Pri-1 -Type-Bug findit-for-crash M-51 Te-Logged Type-Bug-Regression Pri-2
Owner: tfarina@chromium.org
Status: Assigned (was: Available)
Author: tfarina@chromium.org
Component: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/f751653a94ab3b2a187306c1d9c9af004db1e7d8
Time: Tue Feb 18 16:32:55 2014
The CL last changed line 129 of file text_input_controller.cc, which is stack frame 4.

@tfarina: Request you to please take a look into it. Please help us to reassign if not with respect to your change.

Thanks.!
Project Member

Comment 2 by ClusterFuzz, Mar 3 2016 

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4723230192959488

Fuzzer: mbarbella_js_mutation_layout
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  base::internal::Invoker<base::IndexSequence<>,base::internal::BindState<base::in
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=378152:378159

Minimized Testcase (0.07 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97IG4q-ffv0VjWhOrg_IhQqWd_WC8MZJ5WreyVqRnyHpGT8Z2cUJmIVDh0I2wK3f2HmJjAAOj_eHNo08W4QfMDS8B9OS0AwqfH9E6Q83WGdivZ9Und7MZR9NIp0MQAPMtV4eunbPTDi8bLF1E-yrZVw4fLwLw
<script>
"hello", 5;
textInputController.markedRange();
  </script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 3 by ClusterFuzz, Mar 9 2016 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5539346892980224

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  base::internal::Invoker<base::IndexSequence<>,base::internal::BindState<base::in
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=379730:379778

Minimized Testcase (0.06 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94VfhpVG7Fa2gN9ftwWXOuAaarI7WMxyxRqWfan83YaC8f9jMaiOxjh_J9u57YNoYCie2el1cNVjngRWc_pQc3O76cBgbMDzmqZ7cSJV5j76fTZivfoumusQYWcopLynJWGWQ9KqDzyKTbZcxoPNbBua-RSCA
<script>
textInputController.markedRange();
  </script>


Filer: nyerramilli

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 4 by ClusterFuzz, Mar 9 2016 

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5539346892980224

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  base::internal::Invoker<base::IndexSequence<>,base::internal::BindState<base::in
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=379730:379778

Minimized Testcase (0.06 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94VfhpVG7Fa2gN9ftwWXOuAaarI7WMxyxRqWfan83YaC8f9jMaiOxjh_J9u57YNoYCie2el1cNVjngRWc_pQc3O76cBgbMDzmqZ7cSJV5j76fTZivfoumusQYWcopLynJWGWQ9KqDzyKTbZcxoPNbBua-RSCA
<script>
textInputController.markedRange();
  </script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Mar 11 2016 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4643862257074176

Fuzzer: inferno_twister
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  base::internal::Invoker<base::IndexSequence<>,base::internal::BindState<base::in
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=380146:380200

Minimized Testcase (7.64 Kb): https://cluster-fuzz.appspot.com/download/AMIfv962mfxQFwVC8cNjAqSKze6jmzQ76P8SU_DRBXYJUH1wW6b4H2JZKaPxuuDGr8ipP3RjNV8tk7j7S7j5TPN_KlSypG5skwFPouYYLVeu7IbtZZR7ae5yCXKqvKBHlynz1haP3APpgjKDfq7HylFXQ7PUCze0hA

Filer: manoranjanr

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 6 by ClusterFuzz, Mar 16 2016 

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4643862257074176

Fuzzer: inferno_twister
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  base::internal::Invoker<base::IndexSequence<>,base::internal::BindState<base::in
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=380146:380200

Minimized Testcase (7.64 Kb): https://cluster-fuzz.appspot.com/download/AMIfv962mfxQFwVC8cNjAqSKze6jmzQ76P8SU_DRBXYJUH1wW6b4H2JZKaPxuuDGr8ipP3RjNV8tk7j7S7j5TPN_KlSypG5skwFPouYYLVeu7IbtZZR7ae5yCXKqvKBHlynz1haP3APpgjKDfq7HylFXQ7PUCze0hA

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Mar 18 2016 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6544096096681984

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  v8::internal::Heap::AllocateFixedArrayWithFiller
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=380964:381388

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96cN_2PEgcE6v_5G9-MrFru1BeoeMh0AWKoLLGw9f6CT7WJiCuCeGLTCDhCI1EcHfLliHtX9yVDBVBMBzH0MastgFiF1VyeFb6QYhYVTAE_kI1XhDSInaVBkwW0Bqu1QpfT7affAnRvEuBwNVheebEbB0RZoA


Filer: ligimole

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 8 by ligim...@chromium.org, Mar 18 2016 

Clusterfuzz is still complaining, can we have an update?
Project Member

Comment 9 by ClusterFuzz, Mar 21 2016 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5936655650783232

Fuzzer: inferno_twister
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  base::internal::RunnableAdapter<std::vector<int,std::allocator<int> >
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=381525:381877

Minimized Testcase (5.36 Kb): https://cluster-fuzz.appspot.com/download/AMIfv956aJGPrnjI7Dq_qCxMgaaV6oFa42DKBcEwpqfWQ7bPt9LdUKTb-sKEy1q2tT1zPVOm4IJqN3UBgYODPaFiP-oIf8z3udmm0sCffc639qM7SoYSp27gHj3ac09teuDM2m32BIAr4Ha5FEygL37XK_8NLrfMmw

Filer: ashejole

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 10 by ClusterFuzz, Mar 21 2016 

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6544096096681984

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  v8::internal::Heap::AllocateFixedArrayWithFiller
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=380964:381388

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96cN_2PEgcE6v_5G9-MrFru1BeoeMh0AWKoLLGw9f6CT7WJiCuCeGLTCDhCI1EcHfLliHtX9yVDBVBMBzH0MastgFiF1VyeFb6QYhYVTAE_kI1XhDSInaVBkwW0Bqu1QpfT7affAnRvEuBwNVheebEbB0RZoA


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Mar 24 2016 

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5936655650783232

Fuzzer: inferno_twister
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  base::internal::RunnableAdapter<std::vector<int,std::allocator<int> >
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=381525:381877

Minimized Testcase (5.36 Kb): https://cluster-fuzz.appspot.com/download/AMIfv956aJGPrnjI7Dq_qCxMgaaV6oFa42DKBcEwpqfWQ7bPt9LdUKTb-sKEy1q2tT1zPVOm4IJqN3UBgYODPaFiP-oIf8z3udmm0sCffc639qM7SoYSp27gHj3ac09teuDM2m32BIAr4Ha5FEygL37XK_8NLrfMmw

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by ClusterFuzz, Apr 1 2016 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6481828155752448

Fuzzer: inferno_twister
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  base::internal::RunnableAdapter<std::vector<int,std::allocator<int> >
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=384250:384282

Minimized Testcase (2.72 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97S7__TKvdnd6RXdb7yiklikfdL3M2RkbvnUYH6uzU0LZb9Fylc44r1tFsaE1f9mUMklWUodxn7yqEfP61AetvwOrSMR5TgAYbIso6EB4v1-gwj7Fiei7biMccCEjxMy810RfaRpEjXfYIS2jbi_hmhRVTe7w

Additional requirements: Requires HTTP

Filer: durga.behera

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 13 by ClusterFuzz, Apr 2 2016 

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6481828155752448

Fuzzer: inferno_twister
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  base::internal::RunnableAdapter<std::vector<int,std::allocator<int> >
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=384250:384282

Minimized Testcase (2.72 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97S7__TKvdnd6RXdb7yiklikfdL3M2RkbvnUYH6uzU0LZb9Fylc44r1tFsaE1f9mUMklWUodxn7yqEfP61AetvwOrSMR5TgAYbIso6EB4v1-gwj7Fiei7biMccCEjxMy810RfaRpEjXfYIS2jbi_hmhRVTe7w

Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 14 by ClusterFuzz, Apr 6 2016 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6174840184111104

Fuzzer: mbarbella_js_mutation_layout
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  base::internal::RunnableAdapter<std::vector<int,std::allocator<int> >
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=385305:385342

Minimized Testcase (0.07 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97ZapgcoaWUTIda9HLC6w0HRWnnf_YCY8SzdJBjGfkANaMu0ZuLKikKQympVBX9Qj2aZQ6PEuThxDDI3nw6iyeHcXeGhFC2r9-zhA2J377qSflHjQeg_m6Dd3di0MuyGzXnZc4Y85WM1kiA_2FPhnKTlsf62Q
<script>
textInputController.markedRange();
(function () {
})();
</script>


Filer: mmohammad

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 15 by ClusterFuzz, Apr 8 2016 

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6174840184111104

Fuzzer: mbarbella_js_mutation_layout
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::WebRange::startOffset
  test_runner::TextInputControllerBindings::MarkedRange
  base::internal::RunnableAdapter<std::vector<int,std::allocator<int> >
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=385305:385342

Minimized Testcase (0.07 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97ZapgcoaWUTIda9HLC6w0HRWnnf_YCY8SzdJBjGfkANaMu0ZuLKikKQympVBX9Qj2aZQ6PEuThxDDI3nw6iyeHcXeGhFC2r9-zhA2J377qSflHjQeg_m6Dd3di0MuyGzXnZc4Y85WM1kiA_2FPhnKTlsf62Q
<script>
textInputController.markedRange();
(function () {
})();
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 16 by ClusterFuzz, Jun 13 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 17 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment