New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 620220 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jun 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in chrome::GetBrowserContextRedirectedInIncognito

Project Member Reported by ClusterFuzz, Jun 15 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5040898182479872

Fuzzer: meacer_chromebot_extensions
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  chrome::GetBrowserContextRedirectedInIncognito
  KeyedServiceFactory::GetServiceForContext
  TemplateURLServiceFactory::GetForProfile
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=316761:316782

Minimized Testcase (11.21 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95n79g_zBEcKQVVfx8B9zXPmqJccjALuh8AF4cr8Rv8euWtCxCCE64l5HzbPDu_bq5mIoDJnysJ9C4R4YZaZrU99z2YW-JXXKAgiSwfesOL67ruqvVDf0XX_WmwdnaXDFNvqqYQvap1_AUL6g1G0CYgTxrKXA

Additional requirements: Requires Gestures

Filer: durga.behera

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: e...@chromium.org
Components: Blink
Owner: anthonyvd@chromium.org
Status: Assigned (was: Available)
Suspected CLs:
=================
The result is a list of CLs that change the crashed files.

Author: calamity
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/9382ab44c8438b90cb0afe4de1832189661cc3df
Time: Wed Feb 18 03:43:04 2015
File app_list_view_delegate.cc is changed in this cl (and is part of stack frame #3, "AppListViewDelegate::OnTemplateURLServiceChanged")
Minimum distance from crash line to modified line: 29. (file: app_list_view_delegate.cc, crashed on: 829, modified: 800).

Suspected Project: chromium
===========================
The above CL detected by Findit seems to be unrelated and could not find the suspect from the code search on the crashed files too.
Hence assigned/cced to the file owner from the below link to assign it to an appropriate dev person.
Currently its impacting to the latest Stable (51.0.2704.84) & Beta (52.0.2743.33).
Components: Tools>Test>FindIt>WrongResult
Labels: findit-wrong Te-Logged M-52
Project Member

Comment 4 by sheriffbot@chromium.org, Jun 15 2016

Labels: -M-52 M-53 MovedFrom-52
Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Components: -Blink
Cc: anthonyvd@chromium.org
Owner: calamity@chromium.org
From the stack trace, it looks like this is crashing because profile_ is null when the following line is reached: https://cs.chromium.org/chromium/src/chrome/browser/ui/app_list/app_list_view_delegate.cc?sq=package:chromium&type=cs&l=827

Assigning to one of the owners of that file from chrome/browser/ui/app_list/OWNERS
Project Member

Comment 7 by bugdroid1@chromium.org, Jun 23 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ca75961e35cc647ae8375768b67d61276e14465a

commit ca75961e35cc647ae8375768b67d61276e14465a
Author: calamity <calamity@chromium.org>
Date: Thu Jun 23 04:49:13 2016

Fix crash in app list view delegate.

This CL fixes an issue where an observer was not removed from the
app list view delegate when the profile was set to nullptr. This caused
a crash if the TemplateURLService notified the app list view delegate.

BUG= 620220 

Review-Url: https://codereview.chromium.org/2082933002
Cr-Commit-Position: refs/heads/master@{#401541}

[modify] https://crrev.com/ca75961e35cc647ae8375768b67d61276e14465a/chrome/browser/ui/app_list/app_list_view_delegate.cc

Status: Fixed (was: Assigned)
Project Member

Comment 9 by ClusterFuzz, Jun 24 2016

ClusterFuzz has detected this issue as fixed in range 401535:401544.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5040898182479872

Fuzzer: meacer_chromebot_extensions
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  chrome::GetBrowserContextRedirectedInIncognito
  KeyedServiceFactory::GetServiceForContext
  TemplateURLServiceFactory::GetForProfile
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=316761:316782
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=401535:401544

Minimized Testcase (11.21 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95n79g_zBEcKQVVfx8B9zXPmqJccjALuh8AF4cr8Rv8euWtCxCCE64l5HzbPDu_bq5mIoDJnysJ9C4R4YZaZrU99z2YW-JXXKAgiSwfesOL67ruqvVDf0XX_WmwdnaXDFNvqqYQvap1_AUL6g1G0CYgTxrKXA?testcase_id=5040898182479872

Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Components: -Tools>Test>FindIt>WrongResult
Labels: Test-Predator-Wrong
Project Member

Comment 11 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment