Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6055093080424448 Fuzzer: bj_broddelwerk Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x61100027ec70 Crash State: blink::LayoutFieldset::adjustInnerStyle blink::LayoutObject::setStyle blink::Element::recalcOwnStyle Recommended Security Severity: High Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=409223:409458 Minimized Testcase (2.45 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94QrMuDD7Hi4mT49p3-C_LbeppnREJtjPJusCmO4q4pHDRa4Anb5j33PuHlswuYaEz7PCzE7ZWP0-HOSUtjpdGZxvIbw5u8fHR0mUjCSl6Bc5ATSGZgzGn5bUWhRds6cRWbk6vEgOj8EC0Z99ckx5KVZ6ojGg?testcase_id=6055093080424448 Filer: inferno See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5520419245522944 Fuzzer: attekett_dom_fuzzer Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x7d3c0000e880 Crash State: blink::LayoutBlock::computeChildPreferredLogicalWidths blink::LayoutFieldset::computeIntrinsicLogicalWidths blink::LayoutBox::computeIntrinsicLogicalWidthUsing Recommended Security Severity: High Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=409223:409418 Minimized Testcase (0.67 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96kfZbc_2OvrvqZR7LQPqHIQRmshSgsMRqodNGoWzmbqgQRLpoR1ewpLWe-wP2NWcg841qPL4zXv0DS2RIeFAcLnQ3FZh9A0VxTwQP2_CKsjAvu5HI2-irsrNXuwqbh8jsUU1rFDwNr0K9NjJtRZvqieCt11w?testcase_id=5520419245522944 Filer: inferno See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5937472917995520 Fuzzer: bj_broddelwerk Job Type: linux_cfi_chrome Platform Id: linux Crash Type: Bad-cast Crash Address: 0xf0cf21c6d71a0000 Crash State: Bad-cast to blink::LayoutBlock from invalid vptr blink::LayoutFieldset::addChild blink::LayoutTreeBuilderForText::createLayoutObject Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=409257:409369 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97KUwBUJGsyEBo6njbQCf4CFaWo82husZQJnB4dp929XNMR-dQ9wlzSnoSxBtpYsN6boIIbKLS8RZ0m8jdesenytkbY5IU3fTyezsvm4GdscHNA2xZHZAMf_YtpunbBLt_IllTQEf_e1NONUjQXFfyRUGxOLRH2xq_iex1MbT84wOXosoU?testcase_id=5937472917995520 Additional requirements: Requires Gestures Filer: inferno See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Author: glebl Project: chromium Changelist: https://chromium.googlesource.com/chromium/src//+/c6d69f896f406c9a7801b29cb8c02a88e5b01770 Time: Tue Aug 02 20:22:36 2016 Lines 240 of file LayoutFieldset.cpp which potentially caused crash are changed in this cl (frame #2, "blink::LayoutFieldset::adjustInnerStyle"). Minimum distance from crash line to modified line: 0. (file: LayoutFieldset.cpp, crashed on: 240, modified: 240). Suspected Project: chromium Suspected Component: Blink>Layout
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6453072064937984 Fuzzer: bj_broddelwerk Job Type: linux_cfi_chrome Platform Id: linux Crash Type: Bad-cast Crash Address: 0xc0c301d524370000 Crash State: Bad-cast to blink::LayoutObject from invalid vptr blink::LayoutBlock::computeChildPreferredLogicalWidths blink::LayoutFieldset::computeIntrinsicLogicalWidths Recommended Security Severity: High Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=409257:409369 Minimized Testcase (1.21 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97OdsQNpXAGKP2pqmYD7fmb1NmGl3UWcqmmvWTT3u-89Au2o4vahF5nWg94sme4CXlJbjYuzdWwVFmrQWN0aH_ytXQlSqybI0er4rMpy1_snpoXr8aPPoRI4p4_vhd5UEh6AVliSENEZ9utwAm1YMOIrGzOYA?testcase_id=6453072064937984 Filer: inferno See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5342320910401536 Fuzzer: bj_broddelwerk Job Type: linux_msan_chrome Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: blink::LayoutFieldset::addChild blink::LayoutTreeBuilderForText::createLayoutObject blink::Text::attachLayoutTree Recommended Security Severity: Low Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_chrome&range=409223:409418 Minimized Testcase (8.16 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97lO2hFjlOVdHHZ6SZD7o3HNzUMJfwJO5ekTyjreOSoGem47zAX0ACRoEQvfWYlA71z9Vy2IK_EV7UEZchBXE3BGqiM-Qytz1jg3FPOAtvD8MNY21-ya8a8dDZKeiAIQMzxarkf6RnefGLZAciDUgoerqh2bA?testcase_id=5342320910401536 Additional requirements: Requires Gestures Filer: inferno See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
glebl@, the revert is failing, can you do it manually / take a look at bug and fix it soon.
inferno@, here is the revert that passed tests. https://codereview.chromium.org/2204373002/ thanks.
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779 commit 7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779 Author: glebl <glebl@chromium.org> Date: Thu Aug 04 01:42:48 2016 Revert "Auto-rebaseline for r409303" This reverts commit fbbbbcb99039ef08ae88e51acc0f9e426119ea0b. Revert "Add grid/flex layout support for <fieldset>" This reverts commit c6d69f896f406c9a7801b29cb8c02a88e5b01770. Reason for revert: Causing use-after-frees on ClusterFuzz. BUG= 634114 TBR=dmazzoni@chromium.org Review-Url: https://codereview.chromium.org/2204373002 Cr-Commit-Position: refs/heads/master@{#409698} [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/block/basic/fieldset-stretch-to-legend-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/borders/fieldsetBorderRadius-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/css/invalidation/fieldset-disabled-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-flex-expected.html [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-flex.html [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-grid-expected.html [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-grid.html [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/forms/fieldset/validation-in-fieldset-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/forms/focus-selection-input-expected.txt [rename] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/forms/focus-selection-textarea-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/fast/forms/validity-property-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/paint/masks/fieldset-mask-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/block/basic/fieldset-stretch-to-legend-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/borders/fieldsetBorderRadius-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/css/fieldset-display-row-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/css/invalidation/fieldset-disabled-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/006-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/007-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/fieldset/fieldset-align-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/fieldset/fieldset-with-float-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/fieldset/float-before-fieldset-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/fieldset/validation-in-fieldset-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/focus-selection-input-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/forms/validity-property-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/text/whitespace/normal-after-nowrap-breaking-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/fast/writing-mode/fieldsets-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/paint/masks/fieldset-mask-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/android/svg/custom/inline-svg-in-xhtml-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/linux/fast/block/basic/fieldset-stretch-to-legend-expected.png [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/css/fieldset-display-row-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/006-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/007-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-align-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-with-float-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/float-before-fieldset-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/forms/focus-selection-textarea-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/text/whitespace/normal-after-nowrap-breaking-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/fast/writing-mode/fieldsets-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/linux/svg/custom/inline-svg-in-xhtml-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/block/basic/fieldset-stretch-to-legend-expected.png [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/fieldset/fieldset-align-expected.png [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/text/whitespace/normal-after-nowrap-breaking-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac-mac10.10/svg/custom/inline-svg-in-xhtml-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/fieldset/fieldset-align-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/text/whitespace/normal-after-nowrap-breaking-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac-mac10.9/svg/custom/inline-svg-in-xhtml-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/mac-retina/fast/forms/fieldset/fieldset-align-expected.png [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/css/fieldset-display-row-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/006-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/007-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-align-expected.png [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-align-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-with-float-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/float-before-fieldset-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/mac/fast/forms/focus-selection-textarea-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/text/whitespace/normal-after-nowrap-breaking-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/fast/writing-mode/fieldsets-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/mac/svg/custom/inline-svg-in-xhtml-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/block/basic/fieldset-stretch-to-legend-expected.png [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/css/fieldset-display-row-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/006-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/007-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-align-expected.png [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-align-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-with-float-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/float-before-fieldset-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/forms/focus-selection-textarea-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/text/whitespace/normal-after-nowrap-breaking-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/fast/writing-mode/fieldsets-expected.txt [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/LayoutTests/platform/win/svg/custom/inline-svg-in-xhtml-expected.txt [delete] https://crrev.com/b4de2d326499810f9de7eaadfce6388741956947/third_party/WebKit/LayoutTests/platform/win7/fast/forms/fieldset/fieldset-align-expected.png [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutBlock.cpp [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutFieldset.h [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.h [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutGrid.cpp [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/core/layout/LayoutGrid.h [modify] https://crrev.com/7e3d12d1afc0c5ae0700809a9b43cd6aeaf2e779/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
ClusterFuzz has detected this issue as fixed in range 409660:409712. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5937472917995520 Fuzzer: bj_broddelwerk Job Type: linux_cfi_chrome Platform Id: linux Crash Type: Bad-cast Crash Address: 0xf0cf21c6d71a0000 Crash State: Bad-cast to blink::LayoutBlock from invalid vptr blink::LayoutFieldset::addChild blink::LayoutTreeBuilderForText::createLayoutObject Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=409257:409369 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=409660:409712 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97KUwBUJGsyEBo6njbQCf4CFaWo82husZQJnB4dp929XNMR-dQ9wlzSnoSxBtpYsN6boIIbKLS8RZ0m8jdesenytkbY5IU3fTyezsvm4GdscHNA2xZHZAMf_YtpunbBLt_IllTQEf_e1NONUjQXFfyRUGxOLRH2xq_iex1MbT84wOXosoU?testcase_id=5937472917995520 Additional requirements: Requires Gestures See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
ClusterFuzz has detected this issue as fixed in range 409491:409517. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6453072064937984 Fuzzer: bj_broddelwerk Job Type: linux_cfi_chrome Platform Id: linux Crash Type: Bad-cast Crash Address: 0xc0c301d524370000 Crash State: Bad-cast to blink::LayoutObject from invalid vptr blink::LayoutBlock::computeChildPreferredLogicalWidths blink::LayoutFieldset::computeIntrinsicLogicalWidths Recommended Security Severity: High Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=409257:409369 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=409491:409517 Minimized Testcase (1.21 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97OdsQNpXAGKP2pqmYD7fmb1NmGl3UWcqmmvWTT3u-89Au2o4vahF5nWg94sme4CXlJbjYuzdWwVFmrQWN0aH_ytXQlSqybI0er4rMpy1_snpoXr8aPPoRI4p4_vhd5UEh6AVliSENEZ9utwAm1YMOIrGzOYA?testcase_id=6453072064937984 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
closing per comment #12
ClusterFuzz has detected this issue as fixed in range 409589:409863. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5342320910401536 Fuzzer: bj_broddelwerk Job Type: linux_msan_chrome Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: blink::LayoutFieldset::addChild blink::LayoutTreeBuilderForText::createLayoutObject blink::Text::attachLayoutTree Recommended Security Severity: Low Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_chrome&range=409223:409418 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_chrome&range=409589:409863 Minimized Testcase (8.16 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97lO2hFjlOVdHHZ6SZD7o3HNzUMJfwJO5ekTyjreOSoGem47zAX0ACRoEQvfWYlA71z9Vy2IK_EV7UEZchBXE3BGqiM-Qytz1jg3FPOAtvD8MNY21-ya8a8dDZKeiAIQMzxarkf6RnefGLZAciDUgoerqh2bA?testcase_id=5342320910401536 Additional requirements: Requires Gestures See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Comment 1 by ClusterFuzz
, Aug 3 2016