VisibleSelection::validate() should handle SLOT element outside shadow root |
|||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6051847817396224 Fuzzer: inferno_layout_test_unmodified Job Type: windows_syzyasan_chrome Platform Id: windows Crash Type: UNKNOWN Crash Address: 0x0000000b Crash State: blink::Node::isShadowRoot blink::Node::parentNode blink::Node::parentElement Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=419419:419426 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95lCCH9Izk9wNNNb9MfYJV2p34zqNehJskwejc_1QZO7t4CiOpIJye1tlQhWU-FaK3WSbHUFOJ5-8gR1rMoQRBmrP7kQENvx3c8ByMM1LlS2VH_luuDnwsIzvLmOoIFa19qkMJw5cRhrd5Bg9k_efnujGOHUw?testcase_id=6051847817396224 Additional requirements: Requires Gestures Issue manually filed by: kavvaru See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Sep 20 2016
This crash is not related to my change. @timloh, It may be related to your change. commit f3c212113fa3578799a243e1940e533ac6eac927 author timloh <timloh@chromium.org> Mon Sep 19 10:21:26 2016 committer Commit bot <commit-bot@chromium.org> Mon Sep 19 10:23:03 2016 CSS Properties and Values API: Support more syntax strings
,
Sep 20 2016
,
Sep 20 2016
,
Sep 21 2016
yosin@/nektar@, could you please take a look and please help us to find correct owner if it is not related your changes.
,
Sep 21 2016
CF script appends SLOT element to TABLE. It seems we should handle SLOT element outside shadow root case.
,
Oct 12 2016
Gentle Ping! yosin@, do we have any further update on this? Thank you!
,
Oct 12 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Nov 30 2016
Below test is succeeded.
TEST_F(PositionTest, comparePositions) {
setBodyContent("<slot id='slot1'></slot><slot id='slot2'></slot>");
Element* const slot1 = document().getElementById("slot1");
Element* const slot2 = document().getElementById("slot2");
PositionInFlatTree position1(slot1, 0);
PositionInFlatTree position2(slot2, 0);
EXPECT_TRUE(position1 < position2) << position1 << ' ' << position2;
}
,
Nov 30 2016
,
Nov 30 2016
|
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by kavvaru@chromium.org
, Sep 20 2016Labels: Findit-for-crash M-55 Te-Logged
Owner: shanmug...@samsung.com
Status: Assigned (was: Untriaged)