New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 628076 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner: ----
Closed: Nov 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

positionWithAffinity.position().inShadowIncludingDocument(). LI class="c0"@0/Tex

Project Member Reported by ClusterFuzz, Jul 14 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6525645219954688

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  positionWithAffinity.position().inShadowIncludingDocument(). LI class="c0"@0/Tex
  blink::VisiblePositionTemplate<>::create
  blink::createVisiblePosition
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=390316:390330

Minimized Testcase (0.64 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96VPYu-__923BUFYbdW2lv8c0WLYR49XODV4VJB5T4WbuBLgy-CGfyqbqosFjenwhU09m-0UQa0eyAQUwLWpKc_SJ6b3jJOKRl4bA22Q-IW0ONu1OwKWS3MDdJg0XEqXQOvaVeonIwBfFp60fqiEHBqBNMH4g?testcase_id=6525645219954688

Filer: nyerramilli

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: nyerramilli@chromium.org r...@opera.com
Components: Tools>Test>FindIt>NoResult
Labels: findit-wrong M-52
Status: Untriaged (was: Available)
Providing Findit results for internal purpose:
Suspected CLs	Findit could not determine the memory tool from the stacktrace. Is it in a new format?

unable to find the culprit, assigning to https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/OWNERS

rune @- Could you please check the above issue & help us in finding an owner.
Project Member

Comment 2 by ClusterFuzz, Jul 27 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6417690822705152

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  positionWithAffinity.position().isConnected(). #text "\n"@afterAnchor/TextAffini
  blink::VisiblePositionTemplate<>::create
  blink::createVisiblePosition
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=389884:390111

Minimized Testcase (0.38 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97X83pVOsY08IcENP6jxUfe__40zSxzQDsqWj5LlLI8V1ZlNkPX1TePSAypyCOOP_f_utatfaK7-ncbBqcqzh9Ew_gu1K4owE2jXltb9mgL9vu3kWppHDIOWzJ5PJ7n3vIKzcd1RzRZMzlED60KERuIUwmumA?testcase_id=6417690822705152
document.execCommand("Outdent");
  <script>
onload = function() {
    document.designMode = 'on';
    document.execCommand('SelectAll');
    document.execCommand('FormatBlock', false, '<pre>');
};
  </script>
  xyz
<!-- 
-->
  <style>
   .box {
            height: 50px;
  </style>
  <div class="box software_from_none before">
  </div>
  <div class="box software_from_software before">


Filer: rnimmagadda

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 3 by ClusterFuzz, Jul 27 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5151486749442048

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  positionWithAffinity.position().isConnected(). LI class="c1"@afterAnchor/TextAff
  blink::VisiblePositionTemplate<>::create
  blink::createVisiblePosition
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=389884:390111

Minimized Testcase (1.13 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97vogVQWC1xInRi6Wmz6PwOJj1ZR_ENwgB4DSByxeSLwvAXivpyb5cqvAhempMfOIIrSq3mkMYALWs4HcFvXVteXL_WUxmRj4kz2ENy1rnMRJEZH2YAuDLPJZE_ARaO20KVkh5cowUghemQGa7zyks-fXJzHw?testcase_id=5151486749442048

Filer: mmohammad

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 4 by ClusterFuzz, Sep 24 2016

ClusterFuzz has detected this issue as fixed in range 408586:408599.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6525645219954688

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  positionWithAffinity.position().inShadowIncludingDocument(). LI class="c0"@0/Tex
  blink::VisiblePositionTemplate<>::create
  blink::createVisiblePosition
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=390316:390330
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=408586:408599

Minimized Testcase (0.64 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96VPYu-__923BUFYbdW2lv8c0WLYR49XODV4VJB5T4WbuBLgy-CGfyqbqosFjenwhU09m-0UQa0eyAQUwLWpKc_SJ6b3jJOKRl4bA22Q-IW0ONu1OwKWS3MDdJg0XEqXQOvaVeonIwBfFp60fqiEHBqBNMH4g?testcase_id=6525645219954688

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Sep 30 2016

ClusterFuzz has detected this issue as fixed in range 421781:421797.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6417690822705152

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  positionWithAffinity.position().isConnected(). #text "\n"@afterAnchor/TextAffini
  blink::VisiblePositionTemplate<>::create
  blink::createVisiblePosition
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=389884:390111
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=421781:421797

Minimized Testcase (0.38 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97X83pVOsY08IcENP6jxUfe__40zSxzQDsqWj5LlLI8V1ZlNkPX1TePSAypyCOOP_f_utatfaK7-ncbBqcqzh9Ew_gu1K4owE2jXltb9mgL9vu3kWppHDIOWzJ5PJ7n3vIKzcd1RzRZMzlED60KERuIUwmumA?testcase_id=6417690822705152
document.execCommand("Outdent");
  <script>
onload = function() {
    document.designMode = 'on';
    document.execCommand('SelectAll');
    document.execCommand('FormatBlock', false, '<pre>');
};
  </script>
  xyz
<!-- 
-->
  <style>
   .box {
            height: 50px;
  </style>
  <div class="box software_from_none before">
  </div>
  <div class="box software_from_software before">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Components: -Tools>Test>FindIt>NoResult
Status: Fixed (was: Untriaged)
Marking the issue as Fixed as Cluster Fuzz has detected the issue as Fixed as per the Comment# 4 & 5.
Thank You.
Project Member

Comment 8 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment