Heap-use-after-free in test_runner::WebFrameTestClient::didAddMessageToConsole |
|||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5637561412485120 Fuzzer: ochang_domfuzzer Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6150005f37a8 Crash State: test_runner::WebFrameTestClient::didAddMessageToConsole test_runner::WebFrameTestProxy<content::RenderFrameImpl, content::RenderFrameImp blink::ChromeClientImpl::addMessageToConsole Recommended Security Severity: High Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=417611:417632 Minimized Testcase (0.32 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96AMI2Nqin482Y_VVQItIn-9MDXctORqbzNUoG46hEstTl05R628GvxOMLkV5ZVFYpmU3VV0q4PMkGTOIioHRYCkpmCh4NKa_iS1scyISdgruR4WrQ2HDBIH_0mVPLcCTIYFNkT2rKK27gB_VIjrjJ0fOKR6w?testcase_id=5637561412485120 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Sep 14 2016
,
Sep 14 2016
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 15 2016
+lukasza, can you take a look? We're trying to access a dead BlinkTestRunner. My understanding is this is a bug only exposed through content_shell in layout test mode, so we can probably reduce the severity / remove release block label once that's confirmed.
,
Sep 15 2016
Yes - WebFrameTestClient uses a wrong WebTestDelegate that doesn't quite match its lifetime. Unfortunately fixing this is not straightforward, because switching to the right WebTestDelegate has some undesirable side-effects (i.e. which console messages are visible depends on whether WebTestDelegate [which is BlinkTestRunner / RenderViewObserver] wraps a swapped-out or not-swapped-out view; expectation of which console messages should be seen is baked into layout test expectations).
,
Sep 15 2016
Assuming #c5 correctly identifies the root cause, this has only test impact.
,
Sep 15 2016
Should I mark this bug as a duplicate of issue 606594 ? Will that make ClusterFuzz happier? Or should I keep both bugs open, so that ClusterFuzz won't keep reporting the same issue again?
,
Sep 16 2016
,
Oct 21 2016
,
Dec 5 2016
ClusterFuzz testcase is flaky and no longer reproduces, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Mar 14 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by penny...@chromium.org
, Sep 13 2016Labels: Pri-1
Owner: dcheng@chromium.org
Status: Assigned (was: Untriaged)