New issue
Advanced search Search tips

Issue 631991 link

Starred by 1 user
Status: Duplicate
Merged: issue 631384
Owner: ----
Closed: Jul 2016
Cc:
editing-dev@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Regression



Sign in to add a comment

InsertHTML crashes with bogus SPAN.

Project Member Reported by ClusterFuzz, Jul 27 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4788509466689536

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000003
Crash State:
  blink::hasEditableLevel
  blink::hasEditableStyle
  blink::CompositeEditCommand::insertNodeBefore
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=408050:408071

Minimized Testcase (0.37 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94azl-oSRpG750co8PvbjvB2rfAyzikrSO7zgFvaDhsQEz5oJbrtzjioMd6qDr-b9X-nwst1YuDTcHUi8LJIksclhY7Fkk9JqcMrLo9xj4hAe6p9vgEESHfqOX_dY-V9LVjPw7dhxkrsxY8ACR5b7m7Gr1VUw?testcase_id=4788509466689536

Filer: rnimmagadda

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by rnimmagadda@chromium.org, Jul 27 2016

Components: Blink>Editing Tools>Test>FindIt>CorrectResult
Labels: -Pri-1 -Type-Bug M-54 Findit-for-crash Te-Logged Pri-2 Type-Bug-Regression
Owner: yoichio@chromium.org
Status: Assigned (was: Untriaged)
Suspecting:

Author: yoichio
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/ea062aa9a0f814b1ba88bbe3151e057e5aba60e8
Time: Wed Jul 27 05:59:06 2016
Lines 259, 318 of file EditingUtilities.cpp which potentially caused crash are changed in this cl (frame #1, "content_shell!blink::hasEditableLevel+0x15"; frame #2, "content_shell!blink::hasEditableStyle+0x6a").

Files CompositeEditCommand.cpp, ReplaceSelectionCommand.cpp are changed in this cl (and is part of stack frame #3, "content_shell!blink::CompositeEditCommand::insertNodeBefore+0x33"; frame #5, "content_shell!blink::CompositeEditCommand::apply+0x78")
Minimum distance from crash line to modified line: 0. (file: EditingUtilities.cpp, crashed on: 259, modified: 259).

@yoichio: Could you please look into this issue.

Thank you.

Comment 2 by yosin@chromium.org, Jul 28 2016

Components: -Blink>Editing Blink>Editing>Command
Owner: ----
Status: Available (was: Assigned)
Summary: InsertHTML crashes with bogus SPAN. (was: Crash in blink::hasEditableLevel)
DOM tree at DCHECK:

m_endingSelection.showTreeForThis()
BODY	000004761D6E3170
	DIV	000004761D6E31D8 (editable) (focused)
		#text	000004761D6E3240 "\n   "
		B	000004761D6E3310 ID="test" (editable)
			#text	000004761D6E37E0 "\n             a"
			DIV	000004761D6E35A0 (editable)
				#text	000004761D6E3608 "foo"
			DIV	000004761D6E36C0 (editable)
				#text	000004761D6E3728 "bar"
SE			#text	000004761D6E33C8 "ll 79 news articles\n  "
			SCRIPT	000004761D6E3418 (editable)
				#text	000004761D6E3490 "... script ..."
<void>

Comment 3 by yosin@chromium.org, Jul 28 2016

Mergedinto: 631184
Status: Duplicate (was: Available)
Same test case of  issue 631184

Comment 4 by yosin@chromium.org, Jul 28 2016

Mergedinto: -631184 631384
Project Member

Comment 5 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment