New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 627353 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Jul 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 1
Type: Bug



Sign in to add a comment

Crash in blink::WebAXObject::showContextMenu

Project Member Reported by ClusterFuzz, Jul 12 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4704989373267968

Fuzzer: inferno_twister
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: UNKNOWN READ
Crash Address: 0x000000000010
Crash State:
  blink::WebAXObject::showContextMenu
  gin::internal::Dispatcher<void
  v8::internal::FunctionCallbackArguments::Call
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_content_shell&range=403281:403408

Minimized Testcase (3.43 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97Ya5-2MN0uyXs8QkzxFGFfNf-wN4cDkuu8vbS_QE92Pt6yjjr7GHsWWpex_P2QMCYqc2KiHzw_JeQ-WTPg5v8y0phN3dflu52_FFAeBM-tjnAWtfVXhSwV2RkluvxQ5SBAQV6jwbPP_bpUUZpCgYrLRmcoDg?testcase_id=4704989373267968

Filer: nyerramilli

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: nyerramilli@chromium.org
Components: Tools>Test>FindIt>WrongResult Blink>DOM
Labels: findit-wrong Te-Logged
Owner: nek...@chromium.org
Status: Assigned (was: Available)
using codesearch, seeing some changes to 'WebAXObject.cpp' in https://chromium.googlesource.com/chromium/src/+/70770adcfe2262b6886e19ac445d7c791892d011

nektar#, Could you please take a look at the issue and assign it to concerned developer if your changes are not responsible?

providing Findit results for internal purpose:

Suspected CLs	No CL in the regression range changes the crashed files. The result is the blame information.

Author: mjs@apple.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/554c7634cddfec7925865257d362fa718c34ac3a
Time: Thu May 06 22:41:15 2010
The CL last changed line 749 of file Node.h, which is stack frame 0.

Author: commit-queue@webkit.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/a617e8a70e2f33152f9b00a7f6e86cd8ba8a29b5
Time: Sat Apr 21 00:18:20 2012
The CL last changed line 244 of file Node.h, which is stack frame 1.

Author: dmazzoni@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/c979da1ccf0412520c3813294a3d8671955481db
Time: Wed May 13 18:54:38 2015
The CL last changed line 974 of file WebAXObject.cpp, which is stack frame 2.

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/77d41139d261342a429d2775c59d8e8a386d4c81
Time: Wed Mar 09 09:47:03 2016
The CL last changed line 389 of file callback.h, which is stack frame 3.

Author: kolczyk
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/735c49b6ad67166ccbcc8e3717681bb560fbf1cf
Time: Fri Oct 24 13:06:04 2014
The CL last changed line 183 of file function_template.h, which is stack frame 4.

Author: kolczyk
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/735c49b6ad67166ccbcc8e3717681bb560fbf1cf
Time: Fri Oct 24 13:06:04 2014
The CL last changed line 217 of file function_template.h, which is stack frame 5.

Author: verwaest
Project: chromium-v8
Changelist: https://chromium.googlesource.com/v8/v8.git/+/5c73b25ff58e32bcd69153de15a786210769426c
Time: Thu Mar 10 12:14:46 2016
The CL last changed line 19 of file api-arguments.cc, which is stack frame 6.

Suspected Project: chromium
Suspected Component: Blink>DOM


Project Member

Comment 2 by ClusterFuzz, Jul 12 2016

ClusterFuzz has detected this issue as fixed in range 404238:404340.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4704989373267968

Fuzzer: inferno_twister
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: UNKNOWN READ
Crash Address: 0x000000000010
Crash State:
  blink::WebAXObject::showContextMenu
  gin::internal::Dispatcher<void
  v8::internal::FunctionCallbackArguments::Call
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_content_shell&range=403281:403408
Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_content_shell&range=404238:404340

Minimized Testcase (3.43 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97Ya5-2MN0uyXs8QkzxFGFfNf-wN4cDkuu8vbS_QE92Pt6yjjr7GHsWWpex_P2QMCYqc2KiHzw_JeQ-WTPg5v8y0phN3dflu52_FFAeBM-tjnAWtfVXhSwV2RkluvxQ5SBAQV6jwbPP_bpUUZpCgYrLRmcoDg?testcase_id=4704989373267968

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 3 by ClusterFuzz, Jul 13 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Components: -Tools>Test>FindIt>WrongResult
Labels: Test-Predator-Wrong
Project Member

Comment 5 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment