New issue
Advanced search Search tips

Issue 593524 link

Starred by 0 users

Issue metadata

Status: Verified
Owner: ----
Closed: Mar 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 2
Type: Bug



Sign in to add a comment

Indent command crashes with mixed visibility

Project Member Reported by ClusterFuzz, Mar 10 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5305984609681408

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  ASSERTION FAILED: a.isNotNull()
  blink::comparePositions
  blink::CompositeEditCommand::moveParagraphWithClones
  

Minimized Testcase (0.60 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97pdetG0GoIS-za-NcT7GbI8idbmvvbZjAqVOhSxGB0SYgrB_kbtxAxZwzOll2ih17JZvRf4pPei_pOI0_Q1lDRntiet9jeJMCwF1ysyd7mumBy3CFeUmNSPnuIY34pB2PnPvIUAATZyeIT5YQzr1dSTTTP0g

Filer: pbommana

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Owner: yosin@chromium.org
Status: Assigned (was: Available)
Based on offline chat and cs.chromium.org chromium//src/third_party/WebKit/Source/core/editing/OWNERS assigning bug to yosin@
Components: Blink>Editing
Labels: -cr-blink-editing
Remove Cr-* labels, replace w/ component

Comment 3 by yosin@chromium.org, Mar 22 2016

Labels: -OS-Linux -Pri-1 OS-All Pri-2
Owner: ----
Status: Available (was: Assigned)
Summary: Indent command crashes with mixed visibility (was: ASSERTION FAILED: a.isNotNull())
Lower to Pri-2, since real world usage of "Indent" command is low

DOM tree at assertion:
m_endingSelection.showTreeForThis()
BODY	0000010DBA823408 (editable)
	BODY"<	0000010DBA823470 (editable)
		#text	0000010DBA8234D8 "\n "
		STYLE	0000010DBA823528 (editable)
			#text	0000010DBA8235B8 "\n   ul.collapse {\n    visibility:hidden;\n}\nli:first-child {\n    visibility:visible;\n"
		#text	0000010DBA823608 "\n  "
		SCRIPT	0000010DBA823658 (editable)
			#text	0000010DBA8236D0 "\n   try {\nwindow.onload = function() {\n    document.designMode = 'on';\n    document.execCommand('SelectAll');\n    document.execCommand('Indent', false);\n    document.body.textContent = 'PASS; NOT CRASHED';\n        testRunner.dumpAsText();\n};\n} catch(e) { print("Caught: " + e); }\n  "
		#text	0000010DBA823720 "\n "
		UL	0000010DBA823770 CLASS="collapse" (editable)
			#text	0000010DBA8237D8 "\n   "
			UL	0000010DBA8238E0 (editable)
			LI	0000010DBA823828 (editable)
SE				#text	0000010DBA823890 "\n    xyz\n   "
<void>
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 5 by ClusterFuzz, Mar 1 2017

ClusterFuzz has detected this issue as fixed in range 431480:431542.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5305984609681408

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  ASSERTION FAILED: a.isNotNull()
  blink::comparePositions
  blink::CompositeEditCommand::moveParagraphWithClones
  
Sanitizer: address (ASAN)

Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=431480:431542

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95Nllrs5OAc_4rYppPMHuR3tZEA9ERYvM2SSSsbiMp0PcVr_5LCGoPsRMbJvTnzDKOnMIarL2dcFUATpgo8tQMv81cYU5JMtU-W970c--sTaVbh245N-AOnXUul05J9JS2kbTDEoEpcJgD5iaXdb_73Vl10Kg?testcase_id=5305984609681408


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Mar 1 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 5305984609681408 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment