Issue metadata
Sign in to add a comment
|
Check failure in !start.document()->needsLayoutTreeUpdate() in TextIterator.cpp |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6566499838066688 Fuzzer: inferno_layout_test_unmodified Job Type: linux_debug_content_shell_drt Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: !start.document()->needsLayoutTreeUpdate() in TextIterator.cpp blink::TextIteratorAlgorithm<>::TextIteratorAlgorithm blink::createPlainText<> Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=389343:389363 Minimized Testcase (0.34 Kb): https://cluster-fuzz.appspot.com/download/AMIfv974sfr2uLFEkuXG0qe7csb_LIiRHFiFzq-bhnIIHr3xAVrpB_c3zdcVLsk5lYoz3n0kjOsL-fHXSaXvFKUCkH0p4K7s0VmsltQrDLk14nf3m4lmn8Xu3tUx4pSuyWeptQ-u0huhj7he1Wrt5DshDqwZvhaIdw?testcase_id=6566499838066688 Filer: nyerramilli See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jul 20 2016
Is DOM tree modified in InPreLayout or AfterPerformLayout?
,
Jul 25 2016
It seems to be an issue of |updateStyleAndLayoutIgnorePendingStylesheets|. In the crash site, |createPlainText| already calls |updateStyleAndLayoutIgnorePendingStylesheets|, but immediately after that, the DCHECK is hit in TextIterator's constructor saying that layout still needs update. Triage to some other component?
,
Jul 26 2016
Triaging to CSS team according to #4.
,
Jul 27 2016
,
Jul 27 2016
Assigning to TL
,
Aug 7 2016
,
Aug 7 2016
,
Aug 27 2016
ClusterFuzz has detected this issue as fixed in range 414808:414879. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6566499838066688 Fuzzer: inferno_layout_test_unmodified Job Type: linux_debug_content_shell_drt Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: !start.document()->needsLayoutTreeUpdate() in TextIterator.cpp blink::TextIteratorAlgorithm<>::TextIteratorAlgorithm blink::createPlainText<> Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=389343:389363 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=414808:414879 Minimized Testcase (0.34 Kb): https://cluster-fuzz.appspot.com/download/AMIfv974sfr2uLFEkuXG0qe7csb_LIiRHFiFzq-bhnIIHr3xAVrpB_c3zdcVLsk5lYoz3n0kjOsL-fHXSaXvFKUCkH0p4K7s0VmsltQrDLk14nf3m4lmn8Xu3tUx4pSuyWeptQ-u0huhj7he1Wrt5DshDqwZvhaIdw?testcase_id=6566499838066688 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Oct 18 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by nyerramilli@chromium.org
, Jul 15 2016Components: Tools>Test>FindIt>NoResult
Labels: findit-wrong Te-Logged M-52
Owner: yosin@chromium.org
Status: Assigned (was: Available)