New issue
Advanced search Search tips

Issue 619007 link

Starred by 1 user
Status: Duplicate
Merged: issue 637423
Owner:
majidvp@chromium.org
Closed: Sep 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug



Sign in to add a comment

Crash in blink::findSnapContainer

Project Member Reported by ClusterFuzz, Jun 10 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5001552607838208

Fuzzer: inferno_twister
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::findSnapContainer
  blink::SnapCoordinator::snapAreaDidChange
  blink::LayoutBox::updateScrollSnapMappingAfterStyleChange
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=398867:398897

Minimized Testcase (0.29 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94vZtwUvibJHhzlG5TV2fiMrszBLfMitMQ6bQN2LRGuFe7NYkZWYuZLCKqBQFPWAcLuCDo3yRvM94V-JQwoaHCM7XW1CHwlsXvWEe8L15zs5fH4FDPlsQS8ucvePjxl6XIyO3o_Rib0si_T4OMvuGQFyb9K1A
Mixed prefixed and unprefixed requests<script src=full-screen-test.js></script>
<script>

var div = document.querySelector("div");

runWithKeyDown(function() { div.webkitRequestFullscreen(); });
</script>
<style>
* { text-emphasis-position: above left; scroll-snap-coordinate: left 68px top 54px;


Filer: ashejole

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by ashej...@chromium.org, Jun 10 2016

Components: Tools>Test>FindIt>NoResult Blink>Layout
Labels: Te-Logged

Comment 2 by ashej...@chromium.org, Jun 10 2016

Labels: Needs-triage
Status: Untriaged (was: Available)

Comment 3 by e...@chromium.org, Jun 17 2016

Components: -Blink>Layout -Tools>Test>FindIt>NoResult Blink>Scroll
snap-scroll issue, over to scrolling team for triage.

Comment 4 by dtapu...@chromium.org, Jun 17 2016

Labels: Hotlist-Input-Dev
Owner: majidvp@chromium.org
Status: Assigned (was: Untriaged)
majidvp@ I think this is your code...
Project Member

Comment 5 by ClusterFuzz, Jul 7 2016 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6494756033265664

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000038
Crash State:
  blink::SnapCoordinator::snapAreaDidChange
  blink::LayoutBox::updateScrollSnapMappingAfterStyleChange
  blink::LayoutBox::insertedIntoTree
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=392988:393062

Minimized Testcase (1.56 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97v6FGaqPvZhelXC1yInc5tH1IuFzDTKf5917OQu1-XHyRFQxWrkWLm1SVZc7_LJDqUYu1z9pAmmNbgndELzd-_wRCDGUtgYj976h2UOfZ3TxWKTNTAHWfmOqyDg3w9fXG3MMtuFD5fIn2PptPp9sen5ufTJA?testcase_id=6494756033265664

Filer: mummareddy

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 6 by ClusterFuzz, Jul 15 2016 

ClusterFuzz has detected this issue as fixed in range 405467:405500.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6494756033265664

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000038
Crash State:
  blink::SnapCoordinator::snapAreaDidChange
  blink::LayoutBox::updateScrollSnapMappingAfterStyleChange
  blink::LayoutBox::insertedIntoTree
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=392988:393062
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=405467:405500

Minimized Testcase (1.56 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97v6FGaqPvZhelXC1yInc5tH1IuFzDTKf5917OQu1-XHyRFQxWrkWLm1SVZc7_LJDqUYu1z9pAmmNbgndELzd-_wRCDGUtgYj976h2UOfZ3TxWKTNTAHWfmOqyDg3w9fXG3MMtuFD5fIn2PptPp9sen5ufTJA?testcase_id=6494756033265664

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 7 by thestig@chromium.org, Jul 16 2016

Labels: -Needs-triage
Project Member

Comment 8 by ClusterFuzz, Jul 26 2016 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5197101114064896

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000013
Crash State:
  blink::findSnapContainer
  blink::SnapCoordinator::snapAreaDidChange
  blink::LayoutBox::updateScrollSnapMappingAfterStyleChange
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=407355:407359

Minimized Testcase (0.24 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97yRbjFYKUFTbvIGaeVGs-vGd-phdGrMTKy1DlQvOUZz9TAWzynnt53Ougu_1kJvh2li0L-BemBWzrc2hVTMRHcBTlW9j05Rniw8-4QsmgiQnGZBQ9XkRdf3aYMiukFg_ekDb5h3UNUIBSSKibFyGflIkYW7g?testcase_id=5197101114064896
<style>html {
    }
#video {
    scroll-snap-coordinate: 10px 10px;
</style><video id="video"><script src="full-screen-test.js"</script>
</script>
    <script>
        runWithKeyDown(function(){video.webkitRequestFullScreen()});
    </script>


Filer: rnimmagadda

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 9 by ClusterFuzz, Jul 27 2016

Labels: Stability-Memory-AddressSanitizer
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6369223727382528

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000058
Crash State:
  blink::SnapCoordinator::snapAreaDidChange
  blink::LayoutBox::updateScrollSnapMappingAfterStyleChange
  blink::LayoutBox::insertedIntoTree
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=392988:393062

Minimized Testcase (0.22 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94GoS8-4L5tmNl4p3Zu3KPFlSrfwagXZHriLDCsNZzHQXIwxisY8-xEMMsAGL4HToCB3cT2jkxmeLijZ53FepDLUec936MrY6ogo0ah2tWyMCAsHHflNjQ88YjZvKG4ecJoOYFIbF6AjxO_HDcfml5jPzIoBA?testcase_id=6369223727382528
<style>#video {
    scroll-snap-coordinate: 10px 10px;
</style><video id="video"><script src="full-screen-test.js"</script>
</script>
    <script>
        runWithKeyDown(function(){video.webkitRequestFullScreen()});
    </script>


Filer: rnimmagadda

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 10 by majidvp@chromium.org, Sep 13 2016

Mergedinto: 637423
Status: Duplicate (was: Assigned)
Project Member

Comment 11 by ClusterFuzz, Nov 15 2016 

ClusterFuzz has detected this issue as fixed in range 431875:431896.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6369223727382528

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000058
Crash State:
  blink::SnapCoordinator::snapAreaDidChange
  blink::LayoutBox::updateScrollSnapMappingAfterStyleChange
  blink::LayoutBox::insertedIntoTree
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=392988:393062
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=431875:431896

Minimized Testcase (0.22 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94GoS8-4L5tmNl4p3Zu3KPFlSrfwagXZHriLDCsNZzHQXIwxisY8-xEMMsAGL4HToCB3cT2jkxmeLijZ53FepDLUec936MrY6ogo0ah2tWyMCAsHHflNjQ88YjZvKG4ecJoOYFIbF6AjxO_HDcfml5jPzIoBA?testcase_id=6369223727382528
<style>#video {
    scroll-snap-coordinate: 10px 10px;
</style><video id="video"><script src="full-screen-test.js"</script>
</script>
    <script>
        runWithKeyDown(function(){video.webkitRequestFullScreen()});
    </script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment