ASSERTION FAILED: !document().isActive() || !document().needsLayoutTreeUpdateFor |
|||||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4526197584691200 Fuzzer: mbarbella_js_mutation_layout Job Type: linux_debug_content_shell_drt Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: ASSERTION FAILED: !document().isActive() || !document().needsLayoutTreeUpdateFor blink::Element::isFocusable blink::Element::focus Minimized Testcase (0.22 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96e-RH0hD3FSiK3TUxNByMZiMKQ7GPqDEnRrkX3fcN5VLuq1R3-EBpLQ4e-HOJ1cIwJSFKWJsIuc_rvvzgI5n6cshuiT5tw_a6GOFSLhE61y05nBrBn2arWIXSf5B8WR6YDtN1hJQuLmrDaYuNhtlFavn3pIQ <style> #target { -webkit-filter: url(#emptyMerge); </style> <div id="target"> <svg> <filter id="emptyMerge"> <tspan> <script> var __v_0 = document.querySelector("tspan"); __v_0.focus(); </script> Filer: durga.behera See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Mar 31 2016
I'll take a look at this. Anyway, this doesn't look Pri-1.
,
Apr 4 2016
This is due to non-empty m_layerUpdateSVGFilterElements, which makes Document::needsFullLayoutTreeUpdate() true. Looks a SVG area issue.
,
Apr 4 2016
,
Apr 4 2016
Note that replacing document().updateLayoutIngorePendingStylesheetsForNode() in Element::focus() with document().updateLayoutTreeForNode(this) fixes this assertion failure.
,
Apr 7 2016
,
Jul 21 2016
,
Jul 21 2016
,
Sep 21 2016
ClusterFuzz testcase is verified as fixed, closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Sep 22 2016
Is's not fixed.
,
Nov 11 2016
ClusterFuzz has detected this issue as fixed in range 431234:431235. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4526197584691200 Fuzzer: mbarbella_js_mutation_layout Job Type: linux_debug_content_shell_drt Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: !document().isActive() || !document().needsLayoutTreeUpdateForNode(*this) blink::Element::isFocusable blink::Element::focus Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=374251:374424 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=431234:431235 Minimized Testcase (0.27 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv97DeBueqxHNnVEpVAxPrFQMbrhmjMvrLETa1Q44ZxFWkEsx7rFI5PgnoXh1qfxa8aOAylw-nOmQ9AOc90JGEZYhL12jzTiF7Y5x0fmERu-346SMHGxMXFAcAfgojJ-32dD7AFJ0JJU2TGywJ7nm2F_sNBaqhA?testcase_id=4526197584691200 <head> <style> #target { width: 100px; -webkit-filter: url(#emptyMerge); </style> onload="__f_106();"<div id="target"> <svg height="0"> <filter id="emptyMerge"> <tspan> <script> var __v_0 = document.querySelector("tspan"); __v_0.focus(); </script> See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 11 2016
r431235 (c5de692783f306d25186d46039f8541c9c4ebbe0) got rid of m_layerUpdateSVGFilterElements, so if it sticks (this time) it may well have fixed this issue.
,
Nov 11 2016
Awesome! Clusterfuzz seems to agree, so I'll mark this as fixed.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Apr 5 2017
,
Sep 29 2017
,
Sep 29 2017
|
|||||||||||||
►
Sign in to add a comment |
|||||||||||||
Comment 1 by durga.behera@chromium.org
, Mar 30 2016Owner: tkent@chromium.org
Status: Assigned (was: Available)