user-select:all should not make elements not editable |
|||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4535992346476544 Fuzzer: ochang_domfuzzer Job Type: linux_asan_chrome_v8_arm Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000008 Crash State: blink::PositionTemplate<blink::EditingAlgorithm<blink::NodeTraversal> >::lastPos blink::ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded blink::ApplyBlockElementCommand::formatSelection Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=395786:395857 Minimized Testcase (0.29 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96C-FGmMqFThlW9VjyEn24_Ai3jtsB5I4oj4G4YdFY9h8g3Zadbwf76rdvuNCZVKW8frX3lAvhzTDLhtO2C5QlD6t-dqdcCU8aa1ZU24LDCL2tEO-rSES8xiy6KvNW9febIIhn_E__Q7ZyLnveQYaVY_M4G9w <style>body { } pre { -webkit-user-select: all; </style><script> function fuzz() { document.designMode = 'on'; document.execCommand("selectAll"); document.execCommand("FormatBlock",false,"footer"); } setTimeout(fuzz); </script>Test: <pre>!DOCTYPE HTML> </pre> Expected result: <span Filer: durga.behera See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jun 27 2016
,
Jul 5 2016
The root cause is ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded() attempt to split text node in un-editable container node.
,
Jul 5 2016
The root cause is elements which have user-select:all aren't editable.
In below example, PRE element should be editable.
Minimal test case:
<!doctype html>
<div contenteditable id="sample">
foo
<pre style="-webkit-user-select: all">bar
</pre>
baz
</div>
<script>
getSelection().selectAllChildren(document.getElementById('sample'));
document.execCommand('FormatBlock', false, 'h1');
</script>
Layout Tree: PRE should be editable
BODY 0000016CC90C3100
DIV 0000016CC90C3168 ID="sample" (editable) (focused)
H1 0000016CC90C3440 (editable)
SE #text 0000016CC90C34A8 "\nfoo\n"
PRE 0000016CC90C3220 STYLE="-webkit-user-select: all"
#text 0000016CC90C3288 "bar\n"
#text 0000016CC90C32D8 "\nbaz\n"
#text 0000016CC90C3328 "\n"
SCRIPT 0000016CC90C3378
#text 0000016CC90C33F0 "\ngetSelection().selectAllChildren(document.getElementById('sample'));\ndocument.execCommand('FormatBlock', false, 'h1');\n"
,
Jul 5 2016
Moving this nonessential bug to the next milestone. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jul 6 2016
ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4535992346476544 Fuzzer: ochang_domfuzzer Job Type: linux_asan_chrome_v8_arm Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000008 Crash State: blink::PositionTemplate<blink::EditingAlgorithm<blink::NodeTraversal> >::lastPos blink::ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded blink::ApplyBlockElementCommand::formatSelection Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=395786:395857 Minimized Testcase (0.29 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96C-FGmMqFThlW9VjyEn24_Ai3jtsB5I4oj4G4YdFY9h8g3Zadbwf76rdvuNCZVKW8frX3lAvhzTDLhtO2C5QlD6t-dqdcCU8aa1ZU24LDCL2tEO-rSES8xiy6KvNW9febIIhn_E__Q7ZyLnveQYaVY_M4G9w?testcase_id=4535992346476544 <style>body { } pre { -webkit-user-select: all; </style><script> function fuzz() { document.designMode = 'on'; document.execCommand("selectAll"); document.execCommand("FormatBlock",false,"footer"); } setTimeout(fuzz); </script>Test: <pre>!DOCTYPE HTML> </pre> Expected result: <span See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 11 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4971179651891200 Fuzzer: ochang_domfuzzer Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000010 Crash State: blink::PositionTemplate<blink::EditingAlgorithm<blink::NodeTraversal> >::lastPos blink::ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded blink::ApplyBlockElementCommand::formatSelection Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=283013:284047 Minimized Testcase (0.52 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96JRCMiTKLgL1c6-xtPNtueoC_YTprPCGX0EN-Q0iRJBDjHo0GRiqhQNJ81NvUozdFkQn5f4KRL0v2EIymB6_lXi8fWBMtbxLwRxiZUGRorfh2ZzAlirzko5OE3jcNUi4LcWBzgS9i9JBCeE4VJKI8ZIPKB2A?testcase_id=4971179651891200 <style>#log { } #dom-fuzz-13840002 { -webkit-user-select: all; } div { all: unset; </style><script> { ; </script><pre contenteditable="true" id="sample">foo <div id="dom-fuzz-13840002">bar </div> <script style="grid-auto-flow: dense;-webkit-transition-duration: 1ms"> var container = document.getElementById('sample'); var range = document.createRange() range.setEndAfter(container.lastChild); window.getSelection().addRange(range); document.execCommand('formatblock', false, '<h1>'); </script> Filer: mmohammad See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jul 15 2016
ClusterFuzz has detected this issue as fixed in range 405185:405467. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4971179651891200 Fuzzer: ochang_domfuzzer Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000010 Crash State: blink::PositionTemplate<blink::EditingAlgorithm<blink::NodeTraversal> >::lastPos blink::ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded blink::ApplyBlockElementCommand::formatSelection Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=283013:284047 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=405185:405467 Minimized Testcase (0.52 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96JRCMiTKLgL1c6-xtPNtueoC_YTprPCGX0EN-Q0iRJBDjHo0GRiqhQNJ81NvUozdFkQn5f4KRL0v2EIymB6_lXi8fWBMtbxLwRxiZUGRorfh2ZzAlirzko5OE3jcNUi4LcWBzgS9i9JBCeE4VJKI8ZIPKB2A?testcase_id=4971179651891200 <style>#log { } #dom-fuzz-13840002 { -webkit-user-select: all; } div { all: unset; </style><script> { ; </script><pre contenteditable="true" id="sample">foo <div id="dom-fuzz-13840002">bar </div> <script style="grid-auto-flow: dense;-webkit-transition-duration: 1ms"> var container = document.getElementById('sample'); var range = document.createRange() range.setEndAfter(container.lastChild); window.getSelection().addRange(range); document.execCommand('formatblock', false, '<h1>'); </script> See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 15 2016
ClusterFuzz testcase is verified as fixed, closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by durga.behera@chromium.org
, Jun 14 2016Labels: findit-for-crash Te-Logged M-53
Owner: yosin@chromium.org
Status: Assigned (was: Available)