New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 629741 link

Starred by 2 users
Status: Duplicate
Merged: issue 568377
Owner: ----
Closed: Jul 2016
Cc:
█ shans@chromium.org
style-bugs@google.com
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Stack-overflow in blink::CSSSelector::selectorText

Project Member Reported by ClusterFuzz, Jul 20 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6708128179814400

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7ffd8ac83fe8
Crash State:
  blink::CSSSelector::selectorText
  blink::CSSSelector::selectorText
  blink::CSSSelector::selectorText
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=259056:259494

Minimized Testcase (5.75 Kb): https://cluster-fuzz.appspot.com/download/AMIfv947zL9J0BpKZGbA2jEuMfxoKje8Q9rdSunurtwNdmGbUlI1L3LGTL_8ZRdSDAzVx9453jVE8krZBBwefIOs5pNQiNMb97dhwlhm-SVQnJuQuad5qoa-pxw89eW6tirC9rKZklEsPtoIbROD3ZjAjMsIT_58fA?testcase_id=6708128179814400

Filer: shans

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by dtapu...@chromium.org, Jul 20 2016

Components: Blink>CSS
Status: Untriaged (was: Available)

Comment 2 by suzyh@chromium.org, Jul 21 2016

Labels: -Pri-1 Pri-2
Status: Available (was: Untriaged)

Comment 3 by suzyh@chromium.org, Jul 21 2016 

Minimized test case contains the following line:

shouldBe("rule().selectorText = selectorListWithLength(8192); rule().selectorText");

so probably just due to a very large query?

Comment 4 by timloh@chromium.org, Jul 22 2016

Labels: -ClusterFuzz Clusterfuzz
Mergedinto: 568377
Status: Duplicate (was: Available)
Project Member

Comment 5 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment