New issue
Advanced search Search tips

Issue 595961 link

Starred by 0 users

Issue metadata

Status: WontFix
Owner: ----
Closed: Jul 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

insertPargraphSeparator commands hits assertion when inserting into STYLE element

Project Member Reported by ClusterFuzz, Mar 18 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5056377675841536

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  ASSERTION FAILED: endingSelection().isCaretOrRange()
  blink::CompositeEditCommand::moveParagraphs
  blink::CompositeEditCommand::moveParagraph
  

Minimized Testcase (1.85 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95pTuZepKU-VcWIpNY1lISSnEMrBgUJqUaDZCj0CLKTZHHC5LVnzKuvEzDFk6XK9l-b7vLokQZ2WNWrksXZtAEFWUvh9Apy7JxgwnjXMfRGc_wusb6oVz1iU3fp6OM20Ol1UgeV3F_RLGCd9hLy96mXUiMiGg

Filer: ajha

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 

Comment 1 by ajha@chromium.org, Mar 18 2016

Components: Blink>Editing
Labels: findit-for-crash Te-Logged
Owner: tkent@chromium.org
Status: Assigned (was: Available)
Suspected CLs	Regression information is not available. The result is the blame information.

Author: tony@chromium.org
Component: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/3358dc96a8b3bf3f9ea0f8b29ceae8228b73df3e
Time: Tue Mar 09 04:32:08 2010
The CL last changed line 1341 of file CompositeEditCommand.cpp, which is stack frame 0.

Author: tkent
Component: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/2df3e5c169263f58f3da42ef4d2b518a362f2df5
Time: Wed Feb 10 05:12:58 2016
The CL last changed line 1249 of file CompositeEditCommand.cpp, which is stack frame 1.

Author: tkent
Component: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/4ee37b1afc847d9504c046f20602709a98e921dc
Time: Mon Feb 15 07:36:39 2016
The CL last changed line 711 of file DeleteSelectionCommand.cpp, which is stack frame 2.

Author: tkent
Component: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/4ee37b1afc847d9504c046f20602709a98e921dc
Time: Mon Feb 15 07:36:39 2016
The CL last changed line 894 of file DeleteSelectionCommand.cpp, which is stack frame 3.

Author: tkent
Component: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/141f0e9340ec887e341ba89a712c6539205a8292
Time: Tue Feb 09 12:09:23 2016
The CL last changed line 255 of file CompositeEditCommand.cpp, which is stack frame 4.

Author: tkent
Component: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/7f6bd2b6a8e6e4858afd1f1b23d768030a01af69
Time: Wed Feb 10 02:54:06 2016
The CL last changed line 621 of file CompositeEditCommand.cpp, which is stack frame 5.

Author: tkent
Component: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/ebfda00cca02ba3f16493b29f996121cdf265993
Time: Tue Feb 16 04:13:35 2016
The CL last changed line 165 of file InsertParagraphSeparatorCommand.cpp, which is stack frame 6.

Suspected Component: chromium
Suspected Cr- Label: Cr-Blink-Editing
============================================================================================================

tkent@: Could you please take a look at this, for most of the 'CompositeEditCommand.cpp' related changes in the Blame-list.

Thank you!

Comment 2 by tkent@chromium.org, Mar 18 2016

Labels: -Pri-1 Pri-2
Owner: ----
Status: Available (was: Assigned)

Comment 3 by yosin@chromium.org, Mar 22 2016

Summary: insertPargraphSeparator commands hits assertion when inserting into STYLE element (was: ASSERTION FAILED: endingSelection().isCaretOrRange())
insertPargraphSeparator command attempts to insert STYLE element as paragraph separator, since insertion position is enclosed by STYLE element with "display:block"


ASSERTION FAILED: endingSelection().isCaretOrRange()
m_enidngSeleciton is null.

DOM tree before insertPargraphSeparator command:
#document       00000192A8002578 (editable)
        HTML    00000192A8003180 (editable) (focused)
                HEAD    00000192A80031E8 (editable)
                        #text   00000192A8003318 "\n"
                        STYLE   00000192A8003368 (editable)
                                #text   00000192A80033F8 "\n"
                                META    00000192A8003498 (editable)
SE                              #text   00000192A8003568 "*{-webkit-animation-play-state:paused;display:block;"
                        #text   00000192A8003448 "\n"
start: offset, offset:0
end: offset, offset:0
Project Member

Comment 4 by ClusterFuzz, Jul 6 2016

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5056377675841536

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  endingSelection().isCaretOrRange()
  blink::CompositeEditCommand::moveParagraphs
  blink::CompositeEditCommand::moveParagraph
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=275840:275883

Minimized Testcase (3.96 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94aBrrXLyA1EY5wJ5tvce_Xhqj1O96v62wPbq_ThAmEH13lOI3bt_dbsBSBvOmyxdt74nZtA1ES6Ws_t8c8FgFVM70AUxBfpKmjHpZWGQKl7mwELA2AeDafNgdOPzsKLet6JW3RiNNAnymQF32oT8rx_bpG9w?testcase_id=5056377675841536

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 5 by yosin@chromium.org, Jul 7 2016

Status: WontFix (was: Available)
Mark WontFix according to #c4 and I could not reproduce with ToT.
Project Member

Comment 6 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment