Author: hayato
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/fa296ea635357362e48bd203888ae44854d8e748
Time: Tue Jan 12 03:29:07 2016
The CL last changed line 982 of file Node.cpp, which is stack frame 5.

Author: hayato
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/fa296ea635357362e48bd203888ae44854d8e748
Time: Tue Jan 12 03:29:07 2016
The CL last changed line 988 of file Node.cpp, which is stack frame 6.

Suspected Project: chromium
Suspected Component: Blink>DOM

Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I chatted with yosin@ about this issue.

ClusterFuzz has detected this issue as fixed in range 413688:413717.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5996768129187840

Fuzzer: marcin_towalski_cm
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000010
Crash State:
  blink::Node::isChildOfV1ShadowHost
  blink::FlatTreeTraversal::traverseSiblings
  blink::comparePositionsInFlatTree
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=402485:402738
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=413688:413717

Minimized Testcase (0.60 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97qmRLRTiDKehW7v23rs5hyXURIoaoVkOgHwBb6ctBXosaz7TixKCJ3jAHpP56hD0gWgmnhv36Gswj3BvJIOuflQXPYC8VH918xj451bavcXQVe-rFAtbP9qNZBwloziah21wgvPWThCJCuRqzCb35fizz0kA?testcase_id=5996768129187840
<script>nodes = new Array();
function run(){
 nodes[3] = document.getElementById("nod3"); 
 nodes[24] = document.getElementById("nod24"); 
 nodes[25] = document.getElementById("nod25"); 
 nodes[30] = document.getElementById("nod30"); 
 nodes[25].selectionEnd=1073741825; 
 document.execCommand('InsertText') 
 nodes[24].appendChild(nodes[25]) 
 nodes[3].appendChild(nodes[24]) 
 document.execCommand('undo') 
 document.execCommand('Italic') 
}
document.addEventListener("DOMContentLoaded", run);</script>
<table id="nod3" " ></table>
<slot id="nod24" " </slot>
<input id="nod25"</input>
<main id="nod30" " </main>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Re-opening this issue as Clusterfuzz has detected this crash again and last tested version is 414128 against the above clusterfuzz comment fixed in range 413688:413717.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4994428584591360

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000010
Crash State:
  blink::Node::isChildOfV1ShadowHost
  blink::FlatTreeTraversal::traverseSiblings
  blink::comparePositionsInFlatTree
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=402485:402738

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96vIqaKllCFOIzEndSuPFvfC0vvLafLEOvIbYTf9SfGJAAz5d5OsgxlGBEjKavKXXm8CGFqasQb_O0xqpKn0BnHU3s-Rg_9rMda5VpeR-AAwuIBikDV0H0adfsHHg3tWy-ftv5NQz-QArO8krcTmX8VAjJNAw?testcase_id=4994428584591360


Additional requirements: Requires Gestures

Issue manually filed by: durga.behera

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this issue as fixed in range 415918:415934.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4994428584591360

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000010
Crash State:
  blink::Node::isChildOfV1ShadowHost
  blink::FlatTreeTraversal::traverseSiblings
  blink::comparePositionsInFlatTree
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=402485:402738
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=415918:415934

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96vIqaKllCFOIzEndSuPFvfC0vvLafLEOvIbYTf9SfGJAAz5d5OsgxlGBEjKavKXXm8CGFqasQb_O0xqpKn0BnHU3s-Rg_9rMda5VpeR-AAwuIBikDV0H0adfsHHg3tWy-ftv5NQz-QArO8krcTmX8VAjJNAw?testcase_id=4994428584591360


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6497063020003328

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000008
Crash State:
  blink::Node::isChildOfV1ShadowHost
  blink::FlatTreeTraversal::traverseSiblings
  blink::comparePositionsInFlatTree
  

Minimized Testcase (0.33 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95xQmLr-EXaVhUHBcPbhWQ3l9_dY4tzdPQ9EZtXwXYOGlQurM-Pp2H2Xxj5kXjpFT0u6_RVY1WYDdrrUsGdLl66VuZPa8DJTt7OmdK3kSEDWcFpgZBNvsDSLNsVy6dRnwTa9ueEtUCUFlQ7UUHJkm9YYubjGA?testcase_id=6497063020003328
<script>nodes = new Array();
function run(){
 nodes[3] = document.getElementById("nod3"); 
 nodes[24] = document.getElementById("nod24"); 
 nodes[3].appendChild(nodes[24]) 
}
document.addEventListener("DOMContentLoaded", run);</script> {
; <table "="" id="nod3"></table>
<slot id="nod24" "="" <="" slot="">
<input input="" <="" id="nod25">


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this issue as fixed in range 425616:425627.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6497063020003328

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000008
Crash State:
  blink::Node::isChildOfV1ShadowHost
  blink::FlatTreeTraversal::traverseSiblings
  blink::comparePositionsInFlatTree
  
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=425616:425627

Minimized Testcase (0.33 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95xQmLr-EXaVhUHBcPbhWQ3l9_dY4tzdPQ9EZtXwXYOGlQurM-Pp2H2Xxj5kXjpFT0u6_RVY1WYDdrrUsGdLl66VuZPa8DJTt7OmdK3kSEDWcFpgZBNvsDSLNsVy6dRnwTa9ueEtUCUFlQ7UUHJkm9YYubjGA?testcase_id=6497063020003328
<script>nodes = new Array();
function run(){
 nodes[3] = document.getElementById("nod3"); 
 nodes[24] = document.getElementById("nod24"); 
 nodes[3].appendChild(nodes[24]) 
}
document.addEventListener("DOMContentLoaded", run);</script> {
; <table "="" id="nod3"></table>
<slot id="nod24" "="" <="" slot="">
<input input="" <="" id="nod25">


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label.