New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 638483 link

Starred by 1 user
Status: Fixed
Owner:
█ sashab@chromium.org
Last visit > 30 days ago
Closed: Nov 2016
Cc:
ajha@chromium.org
style-bugs@google.com
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

std::isfinite(secondRadius.height()) in CSSGradientValue.cpp

Project Member Reported by ClusterFuzz, Aug 17 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6255720809103360

Fuzzer: inferno_twister
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  std::isfinite(secondRadius.height()) in CSSGradientValue.cpp
  blink::CSSRadialGradientValue::createGradient
  blink::CSSGradientValue::image
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=409173:409180

Minimized Testcase (0.67 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96z7DLG8x9V8QCT-RmbJHu4wcXcokO0suH6QJ5O0pGOTmCihL9EhFaxDmWn8xfHEoWeSaWmdNYAm74mXx4-0pyXe6Z-IcOGyO3KsxpQoMv2mcfzQyFZh_B0tfel5UPBLKEaAnu6WGytosXF8w0h46SkJgZb1w?testcase_id=6255720809103360

Additional requirements: Requires HTTP

Issue manually filed by: ajha

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by ajha@chromium.org, Aug 17 2016

Cc: ajha@chromium.org
Components: Tools>Test>FindIt>NoResult Blink>CSS
Labels: M-54 Te-Logged
Owner: sashab@chromium.org
Status: Assigned (was: Untriaged)
Findit-result
=============
Suspected CLs	Findit could not determine the memory tool from the stacktrace. Is it in a new format?

Based on the code search on 'CSSGradientValue.cpp'.

sashab@: Could you please take a look at this and confirm if this is related to recent works here https://codereview.chromium.org/2221793004.

Thank you!

Comment 2 by sashab@chromium.org, Aug 18 2016

Status: Started (was: Assigned)
It's not related, but I'll happily fix this. :)
Project Member

Comment 3 by bugdroid1@chromium.org, Sep 7 2016 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/dca2fc113095eeae3361b27d44f7da8f61ac1501

commit dca2fc113095eeae3361b27d44f7da8f61ac1501
Author: sashab <sashab@chromium.org>
Date: Wed Sep 07 05:28:53 2016

Fixed DCHECK crash for radial gradients with very large values

Fixed DCHECK crash for radial gradients specified with values near
infinity. This patch clamps the value to numeric_limit<float>.

BUG= 638483 

Review-Url: https://codereview.chromium.org/2259453003
Cr-Commit-Position: refs/heads/master@{#416852}

[add] https://crrev.com/dca2fc113095eeae3361b27d44f7da8f61ac1501/third_party/WebKit/LayoutTests/fast/gradients/css3-radial-gradients-inf-radius-crash.html
[modify] https://crrev.com/dca2fc113095eeae3361b27d44f7da8f61ac1501/third_party/WebKit/Source/core/css/CSSGradientValue.cpp

Comment 4 by kateso...@chromium.org, Oct 18 2016

Components: -Tools>Test>FindIt>NoResult

Comment 5 by sashab@chromium.org, Nov 10 2016

Status: Fixed (was: Started)
Project Member

Comment 6 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment