Crash in blink::ShadowRoot::ensureSlotAssignment |
||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5737745731551232 Fuzzer: inferno_twister Job Type: windows_syzyasan_chrome Platform Id: windows Crash Type: UNKNOWN Crash Address: 0x0000005f Crash State: blink::ShadowRoot::ensureSlotAssignment blink::SlotAssignment::slotAdded blink::HTMLSlotElement::insertedInto Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=409588:409589 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94Wx0WsceEdzztXDpZ9gVRchiXhvtm39KAw-6TpLVoq21oYN3Bxiv1psFC6P4u_5MvKhrbAAq3FyNyf6DeuYrNB5RoOzdLwkuO5pNxKU3F2CKnKwBeretG1vIWvqwsbq_MKGZ0ug6DjbU3xdLhfKhyQff1TR76qpiqUVePwRhhRC_Q7_F8?testcase_id=5737745731551232 Issue manually filed by: mummareddy See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Aug 10 2016
,
Aug 10 2016
,
Aug 16 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/b43d492d6fdd6c44cade1de7c976c402d440a665 commit b43d492d6fdd6c44cade1de7c976c402d440a665 Author: hayato <hayato@chromium.org> Date: Tue Aug 16 07:17:42 2016 Fix a crash: SlotAssignment is unintentionally created for v0 shadow trees HTMLSlotElement::insertedInto() creates SlotAssignment wrongly for a v0 shadow tree because it does *not* check the type of the shadow root. As a result, the entry for the slot would not be removed from the SlotAssignment when the slot is removed from the shadow tree because HTMLSlotElement::removedFrom() *does* check the type of the shadow root correctly. This violates the assumption that a slot in an entry is always in a shadow root, and hit the DCHECK, and causes a crash in a release build. This CL fixes this unintentional wrong behavior. BUG= 634506 Review-Url: https://codereview.chromium.org/2241193004 Cr-Commit-Position: refs/heads/master@{#412184} [add] https://crrev.com/b43d492d6fdd6c44cade1de7c976c402d440a665/third_party/WebKit/LayoutTests/shadow-dom/crashes/slots-in-v0-crash.html [modify] https://crrev.com/b43d492d6fdd6c44cade1de7c976c402d440a665/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp [modify] https://crrev.com/b43d492d6fdd6c44cade1de7c976c402d440a665/third_party/WebKit/Source/core/html/HTMLSlotElement.cpp
,
Aug 17 2016
,
Oct 18 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by mummare...@chromium.org
, Aug 4 2016Labels: M-54 Te-Logged
Owner: hayato@chromium.org
Status: Assigned (was: Untriaged)