Crash in scoped_refptr<base::internal::BindStateBase>::operator= |
||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5892231807893504 Fuzzer: mbarbella_js_mutation_layout Job Type: linux_asan_chrome_v8 Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x000000000008 Crash State: scoped_refptr<base::internal::BindStateBase>::operator= scoped_refptr<base::internal::BindStateBase>::operator= base::internal::CallbackBase::operator= Regressed: V8: r34503:34512 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94p2_ov-Sbxssd5ZRkez_Y-98UMLQ3XcczBylY-wQ0CLNvhRu7srfiReWXs_rwsWfYWSASL64hkfr-dgIM8otWAb11IrcuDsJSmWwu1XF15kk0fDuAeIAgNUHyTHr-5-cONQjM91WW8qAhwG_y4GR4T0p4Y7nK6L1uG8I0DGQifgqld4pQ Additional requirements: Requires Gestures Filer: pucchakayala See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Mar 8 2016
The stack trace is short. Someone called operator= on a null CallbackBack?
,
Mar 8 2016
ClusterFuzz has detected this issue as fixed in range 34515:34516. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5892231807893504 Fuzzer: mbarbella_js_mutation_layout Job Type: linux_asan_chrome_v8 Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x000000000008 Crash State: scoped_refptr<base::internal::BindStateBase>::operator= scoped_refptr<base::internal::BindStateBase>::operator= base::internal::CallbackBase::operator= Regressed: V8: r34503:34512 Fixed: V8: r34515:34516 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94p2_ov-Sbxssd5ZRkez_Y-98UMLQ3XcczBylY-wQ0CLNvhRu7srfiReWXs_rwsWfYWSASL64hkfr-dgIM8otWAb11IrcuDsJSmWwu1XF15kk0fDuAeIAgNUHyTHr-5-cONQjM91WW8qAhwG_y4GR4T0p4Y7nK6L1uG8I0DGQifgqld4pQ Additional requirements: Requires Gestures See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jun 10 2016
Looks like this issue is not longer reproducible, closing the issue for now. Please feel free to raise a new issue or reopen if it reappears.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||
►
Sign in to add a comment |
||||
Comment 1 by pucchakayala@chromium.org
, Mar 8 2016Labels: Te-Logged M-51
Owner: danakj@chromium.org
Status: Assigned (was: Available)