Crash in blink::findSnapContainer |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5515027123798016 Fuzzer: inferno_layout_test_unmodified Job Type: windows_syzyasan_content_shell Platform Id: windows Crash Type: UNKNOWN Crash Address: 0x00000013 Crash State: blink::findSnapContainer blink::SnapCoordinator::snapAreaDidChange blink::LayoutBox::updateScrollSnapMappingAfterStyleChange Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=411522:411529 Minimized Testcase (0.23 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv97KiATOsKhUfFw-nfxb43uVfRlolbG5WgBKaBGzKxMwG1oq8cKKAmxX8iKgbWomwalLCH04rYh_L4OEXyUniE96WaZ5-czl4aZDhBXIH2F3QECkSZbol6-o8sRRbCrDND-Pja6qNd9OVkj6gIgJRIPaJ1-HbQ?testcase_id=5515027123798016 --> <style>#video { scroll-snap-coordinate: 10px 10px; </style><video id="video"><script src="full-screen-test.js"</script> </script> <script> runWithKeyDown(function(){video.webkitRequestFullScreen()}); </script> Issue manually filed by: mmohammad See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Aug 31 2016
,
Aug 31 2016
Reducing the priority to p2. This code path is only ever exercised when an runtime experimental feature (CSSScrollSnapPoints) is active. This is only ever active in our test infrastructure.
,
Sep 13 2016
,
Nov 14 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/4add15dab9bc86608da3158f25a57582e1f86dd0 commit 4add15dab9bc86608da3158f25a57582e1f86dd0 Author: majidvp <majidvp@chromium.org> Date: Mon Nov 14 19:01:25 2016 Handle anonymous layout objects correctly in SnapCoordinator This is done by not assume that |node()| is always available. BUG= 637423 Review-Url: https://codereview.chromium.org/2332383002 Cr-Commit-Position: refs/heads/master@{#431881} [modify] https://crrev.com/4add15dab9bc86608da3158f25a57582e1f86dd0/third_party/WebKit/Source/core/page/scrolling/SnapCoordinator.cpp
,
Nov 15 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by mmohammad@chromium.org
, Aug 12 2016Status: Assigned (was: Untriaged)