New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 612400 link

Starred by 0 users
Status: Duplicate
Merged: issue 462234
Owner: ----
Closed: May 2016
Cc:
█ ander...@apple.com
█ ranjitkan@chromium.org
█ darin@chromium.org
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Crash in blink::Text::wholeText

Project Member Reported by ClusterFuzz, May 17 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6001474831646720

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00009f7537dd
Crash State:
  blink::Text::wholeText
  blink::TextV8Internal::wholeTextAttributeGetter
  blink::TextV8Internal::wholeTextAttributeGetterCallback
  

Minimized Testcase (0.53 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94Sb-XDWH7wMmPJDhDLfINBugp4McjA5l2VyB48aUohzMvjXVrwqUaVnSyunVX9eu26aNkJ1Rly732yZE6CVqyJQ1inwUVPqQyPso4GohyuB7TpY73iOdN-y24L5Lnc2CAgtNWPdyJAcn1nvi5pCJnC3YBOJQ
<script>
            function go() {
                var e = document.getElementById("here");
                var str="A";
                for(var i = 0; i < 22; i++){
                    str += str;
                }
                for(var i = 0; i < 1<<10; i++){             
                    var txt = document.createTextNode(str);
                    e.appendChild(txt);
                }                               
                var txt = e.firstChild.wholeText;
            }
        </script>
<body onLoad="go()"<h1 id="here">


Filer: ranjitkan

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by ranjitkan@chromium.org, May 17 2016

Cc: ranjitkan@chromium.org darin@chromium.org ander...@apple.com
Components: Tools>Test>FindIt>CorrectResult
Labels: -Pri-1 findit-for-crash Te-Logged M-52 Pri-2
Author: andersca@apple.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/f2deb423484a3df7f38b828dda9e26cf5f09d56b
Time: Wed Sep 29 23:05:50 2010
The CL last changed line 175 of file Text.cpp, which is stack frame 0.

@andersca: Request you to please take a look into it.

Comment 2 by sigbjo...@opera.com, May 17 2016

Mergedinto: 462234
Status: Duplicate (was: Available)
Project Member

Comment 3 by ClusterFuzz, Sep 8 2016 

ClusterFuzz has detected this issue as fixed in range 399276:400924.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6001474831646720

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00009f7537dd
Crash State:
  blink::Text::wholeText
  blink::TextV8Internal::wholeTextAttributeGetter
  blink::TextV8Internal::wholeTextAttributeGetterCallback
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=268656:269696
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=399276:400924

Minimized Testcase (0.53 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94m-8L9t_KS3G2NNPBs4TXOOu-cexTkz552LpPcQaJ-zu7qn0gyiz7ZXaQL0EjTt6iXO3p-PuicOrSl5h7h9xK1C0QCAwY-JDIcjvS24jmCA_M9eEZgwKyR45i5_cwQjLq_6pVuqb8YgconesjLCU7Fv62zFQ?testcase_id=6001474831646720
<script>
            function go() {
                var e = document.getElementById("here");
                var str="A";
                for(var i = 0; i < 22; i++){
                    str += str;
                }
                for(var i = 0; i < 1<<10; i++){             
                    var txt = document.createTextNode(str);
                    e.appendChild(txt);
                }                               
                var txt = e.firstChild.wholeText;
            }
        </script>
<body onLoad="go()"<h1 id="here">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment