Crash in blink::ContentDecryptionModuleResultPromise::reject |
||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5363680659374080 Fuzzer: inferno_twister Job Type: linux_asan_chrome_media Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: blink::ContentDecryptionModuleResultPromise::reject blink::ContentDecryptionModuleResultPromise::completeWithError blink::WebContentDecryptionModuleResult::completeWithError Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_media&range=398942:399015 Minimized Testcase (20.94 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96esh8OxE3GFxUDHjyoYooKMEzXbeD69NmuO9x0y3C5gp7xdryQ_ktAXIRLqNcTKSuOMLaAaKa9Dqd1Y9mTh-Ed14g7jBXyu-BqoY0FyQ-nH-Vi8C6rjHIYxw_4TACw9rcRxghakT-XwEcMzFGbBRNnZnjTtYogY9KN7lTKHFZ9uhLjsJo?testcase_id=5363680659374080 Issue manually filed by: ashejole See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Sep 6 2016
Based on the crash it looks like the ExecutionContext is gone. I'll add a check for it.
,
Sep 7 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/d0abaf6c13603474382963075424bf7586558d74 commit d0abaf6c13603474382963075424bf7586558d74 Author: jrummell <jrummell@chromium.org> Date: Wed Sep 07 00:32:22 2016 Add check for null pointer When resources are freed, asynchronous tasks may fail later and cause promises to be rejected. However, since the resource is gone, this crashes. Add a check that the ExecutionContext still exists before using it. BUG= 644269 TEST=test case doesn't crash Review-Url: https://codereview.chromium.org/2314253002 Cr-Commit-Position: refs/heads/master@{#416797} [modify] https://crrev.com/d0abaf6c13603474382963075424bf7586558d74/third_party/WebKit/Source/modules/encryptedmedia/ContentDecryptionModuleResultPromise.cpp
,
Sep 8 2016
ClusterFuzz has detected this issue as fixed in range 416781:416842. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5363680659374080 Fuzzer: inferno_twister Job Type: linux_asan_chrome_media Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: blink::ContentDecryptionModuleResultPromise::reject blink::ContentDecryptionModuleResultPromise::completeWithError blink::WebContentDecryptionModuleResult::completeWithError Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_media&range=398942:399015 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_media&range=416781:416842 Minimized Testcase (20.94 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96esh8OxE3GFxUDHjyoYooKMEzXbeD69NmuO9x0y3C5gp7xdryQ_ktAXIRLqNcTKSuOMLaAaKa9Dqd1Y9mTh-Ed14g7jBXyu-BqoY0FyQ-nH-Vi8C6rjHIYxw_4TACw9rcRxghakT-XwEcMzFGbBRNnZnjTtYogY9KN7lTKHFZ9uhLjsJo?testcase_id=5363680659374080 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 8 2016
ClusterFuzz testcase is verified as fixed, closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||
►
Sign in to add a comment |
||||
Comment 1 by ashej...@chromium.org
, Sep 6 2016Labels: Te-Logged ToolsTestsFindItCorrectResult
Owner: jrumm...@chromium.org
Status: Assigned (was: Untriaged)