listStaticLocalVerifier.isNotRacy() |
||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5785022569381888 Fuzzer: inferno_layout_test_unmodified Job Type: linux_debug_content_shell_drt Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: listStaticLocalVerifier.isNotRacy() blink::whitelistedFunctions blink::DatabaseAuthorizer::allowFunction Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=404947:405052 Minimized Testcase (0.23 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv95sIdku8ebfPD8S6TGlLszkXF6a_Rshm1STXF-_6jUzUdmSc4d0vQ0jLBg_zzwx157gQuL49ggElW9mL7eRI1bl6aG4vlLrjXhrVlbhTTpLgec8RlBni95fDRp11kQ8RMT-5xl4fq-XlMZDIy7CgeWqnyM1bg?testcase_id=5785022569381888 <script> var db = openDatabase('test_db', '1.0', 'Test database', 1024); db.transaction(function(tx) { tx.executeSql('SELECT "AAAAABBBBBCCCCCDDDDEEEEE" REGEXP "(?<!\\ubeaf(\\ubeaf{11000}){11000})"'); location.reload(); }); </script> Filer: nyerramilli See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jul 15 2016
Yeah woops, that's used on the Database thread. https://codereview.chromium.org/2152173002
,
Jul 15 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/24bf381b82d0222181a2d3f8e2184e07c35989da commit 24bf381b82d0222181a2d3f8e2184e07c35989da Author: esprehn <esprehn@chromium.org> Date: Fri Jul 15 08:52:53 2016 Fix static race in DatabaseAuthorizer's whitelistedFunctions. The DatabaseAuthorizer is created on the main thread but used on the database thread, we should use a thread safe static local to do the init. BUG= 628480 Review-Url: https://codereview.chromium.org/2152173002 Cr-Commit-Position: refs/heads/master@{#405727} [modify] https://crrev.com/24bf381b82d0222181a2d3f8e2184e07c35989da/third_party/WebKit/Source/modules/webdatabase/DatabaseAuthorizer.cpp
,
Jul 15 2016
ClusterFuzz has detected this issue as fixed in range 405645:405727. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5785022569381888 Fuzzer: inferno_layout_test_unmodified Job Type: linux_debug_content_shell_drt Platform Id: linux Crash Type: ASSERT Crash Address: Crash State: listStaticLocalVerifier.isNotRacy() blink::whitelistedFunctions blink::DatabaseAuthorizer::allowFunction Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=404947:405052 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=405645:405727 Minimized Testcase (0.23 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv95sIdku8ebfPD8S6TGlLszkXF6a_Rshm1STXF-_6jUzUdmSc4d0vQ0jLBg_zzwx157gQuL49ggElW9mL7eRI1bl6aG4vlLrjXhrVlbhTTpLgec8RlBni95fDRp11kQ8RMT-5xl4fq-XlMZDIy7CgeWqnyM1bg?testcase_id=5785022569381888 <script> var db = openDatabase('test_db', '1.0', 'Test database', 1024); db.transaction(function(tx) { tx.executeSql('SELECT "AAAAABBBBBCCCCCDDDDEEEEE" REGEXP "(?<!\\ubeaf(\\ubeaf{11000}){11000})"'); location.reload(); }); </script> See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 15 2016
,
Jul 25 2016
Issue 630045 has been merged into this issue.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||
►
Sign in to add a comment |
||||
Comment 1 by nyerramilli@chromium.org
, Jul 15 2016Components: Tools>Test>FindIt>CorrectResult
Labels: findit-for-crash Te-Logged
Owner: esprehn@chromium.org
Status: Assigned (was: Available)