ASSERTION FAILED: tagName.namespaceURI() == starAtom |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6509784567644160 Fuzzer: mbarbella_js_mutation_layout Job Type: linux_debug_content_shell_drt Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: ASSERTION FAILED: tagName.namespaceURI() == starAtom void blink::SelectorDataList::collectElementsByTagName<blink::SingleElementSelec void blink::SelectorDataList::execute<blink::SingleElementSelectorQueryTrait> Minimized Testcase (0.16 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv97W56PqbHulAAGasXsgaQyO7m3dNWto0KsCSeMNtGKbfMTEeJkwWUSt0mfygcIbjzLDYKOM56UpL7MbgdoAn6j8_cOIRW08T_tU6evkXZDrz-PtJYQcNChDkvAYNKg0H-KKTKTdJVQqtbWkTRx2xfjOn3QbOA <!DOCTYPE html> <script> shouldNotThrow = function(_a) { eval(_a); } shouldNotThrow("document.querySelector('|pre')"); </script> Filer: ssamanoori See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Apr 22 2016
I guess esprehn's change is more relevant; I think it added the assertion.
,
Apr 27 2016
rune@ I think you regressed this in https://codereview.chromium.org/1616423003 where you removed the check for selectorsNeedNamespaceResolution. I think we used to throw an exception. Safari does match when you do querySelector("|body"), and firefox always returns null. What does the spec say? In either case we shouldn't hit the assert. :)
,
Apr 27 2016
No reason to restrict this, it's a correctness bug not a security issue.
,
Apr 28 2016
We should not throw an exception as "|body" is a valid selector. However, we should not match the html body element as that is in the html namespace and "|body" means it should body elements without a namespace. I'll have a look.
,
Apr 28 2016
Gecko correctly outputs: "2 1" for the demo below:
<!DOCTYPE html>
<body>
<script>
document.body.appendChild(document.createElementNS("", "body"));
console.log(document.querySelectorAll('body').length);
console.log(document.querySelectorAll('|body').length);
</script>
,
Apr 28 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/f0e4bdb8bdd9f2eb306b1ffc29e881c0cc258794 commit f0e4bdb8bdd9f2eb306b1ffc29e881c0cc258794 Author: rune <rune@opera.com> Date: Thu Apr 28 17:46:35 2016 querySelector* fast-path missing namespace check for no namespace. querySelector* does not allow selectors with namespaces, yet selectors with no namespace are still allowed. Check for empty namespace before hitting the fast path for tag names. R=esprehn@chromium.org BUG= 605502 Review-Url: https://codereview.chromium.org/1932673002 Cr-Commit-Position: refs/heads/master@{#390417} [add] https://crrev.com/f0e4bdb8bdd9f2eb306b1ffc29e881c0cc258794/third_party/WebKit/LayoutTests/fast/dom/SelectorAPI/namespaced-elements-and-selectors-expected.txt [add] https://crrev.com/f0e4bdb8bdd9f2eb306b1ffc29e881c0cc258794/third_party/WebKit/LayoutTests/fast/dom/SelectorAPI/namespaced-elements-and-selectors.html [modify] https://crrev.com/f0e4bdb8bdd9f2eb306b1ffc29e881c0cc258794/third_party/WebKit/Source/core/dom/SelectorQuery.cpp
,
Apr 28 2016
,
Apr 29 2016
ClusterFuzz has detected this issue as fixed in range 390399:390423. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6509784567644160 Fuzzer: mbarbella_js_mutation_layout Job Type: linux_debug_content_shell_drt Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: ASSERTION FAILED: tagName.namespaceURI() == starAtom void blink::SelectorDataList::collectElementsByTagName<blink::SingleElementSelec void blink::SelectorDataList::execute<blink::SingleElementSelectorQueryTrait> Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=390399:390423 Minimized Testcase (0.16 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv97W56PqbHulAAGasXsgaQyO7m3dNWto0KsCSeMNtGKbfMTEeJkwWUSt0mfygcIbjzLDYKOM56UpL7MbgdoAn6j8_cOIRW08T_tU6evkXZDrz-PtJYQcNChDkvAYNKg0H-KKTKTdJVQqtbWkTRx2xfjOn3QbOA <!DOCTYPE html> <script> shouldNotThrow = function(_a) { eval(_a); } shouldNotThrow("document.querySelector('|pre')"); </script> See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ssamanoori@chromium.org
, Apr 21 2016Labels: findit-for-crash Te-Logged ToolsTestsFindItCorrectResult M-50
Owner: ch.du...@samsung.com
Status: Assigned (was: Available)