Crash in blink::NavigatorShare::share |
||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4781637827297280 Fuzzer: inferno_twister Job Type: windows_syzyasan_content_shell Platform Id: windows Crash Type: UNKNOWN Crash Address: 0x00000113 Crash State: blink::NavigatorShare::share blink::NavigatorShare::share blink::NavigatorPartialV8Internal::shareMethodPromise Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=408765:408781 Minimized Testcase (4.47 Kb): https://cluster-fuzz.appspot.com/download/AMIfv977rHjOFWAPMCbjHNsM0FkCcFSegmkcjDJt5mGU3zGeQHXQCT7F-8aZknOM9fbszdf5qGoEaAmBGC7KcVD1B5kjkTUp6owgYwTOHfXxTlBgBdEnBQT1SfTW5kKUvFatGX0sN6ThxJKING4LWLYKz_UcCyqNCQ?testcase_id=4781637827297280 Filer: mummareddy See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Aug 16 2016
Really this is my responsibility (sigbjornf@ just made a small change to the file which I wrote). I had a look (didn't look at the actual fuzz file). Not sure what's going on because it implies that LocalFrame::interfaceProvider is returning nullptr, which it isn't supposed to (its factory method explicitly checks for this case and creates one).
,
Sep 14 2016
I spent awhile digging into this, and wasn't able to repro. The proximate cause is that in NavigatorShare::share, the |frame| variable is null. But it's not clear how it can get into that state, and we only have a single case of this happening (even ClusterFuzz can't repro it). I tried downloading the build and running, but no repro. No reports in production. Closing, until we get further crash reports.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||
►
Sign in to add a comment |
||||
Comment 1 by mummare...@chromium.org
, Aug 1 2016Labels: M-54 Te-Logged
Owner: haraken@chromium.org
Status: Assigned (was: Untriaged)