New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 657457 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Not working on Chrome any more
Closed: Nov 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug



Sign in to add a comment

Crash in blink::StyleRuleBase::createCSSOMWrapper

Project Member Reported by ClusterFuzz, Oct 19 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5324554287448064

Fuzzer: inferno_twister
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000003
Crash State:
  blink::StyleRuleBase::createCSSOMWrapper
  blink::StyleRuleBase::createCSSOMWrapper
  blink::CSSStyleSheet::item
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=421755:421761

Minimized Testcase (1.89 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94i8smCIdfEu8SAas9byojiR67JbhKq62NYeH4tGzqxKMF36SOkFT0izNnkm0htWAPB7e1JhQNobg_sDODPAwLhSt4Aesyvd7CSXYwVxirHmX-0w07byxv6gFqCJ0sA0ep3A6ZHN4J3e1dkLgFIWje9Wb8ULQ?testcase_id=5324554287448064

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Owner: dpranke@chromium.org
Status: assigned (was: Untriaged)
dpranke@@ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !
Owner: meade@chromium.org
meade@, can you triage this?

Comment 3 by meade@chromium.org, Oct 25 2016

Cc: meade@chromium.org timloh@chromium.org
Owner: esprehn@chromium.org
Tim, Elliott,

I don't really know what to do with this - I'm traveling right now so I don't have access to my windows machine.

Interestingly the regressed range doesn't include any blink CLs, despite it looking like a nullptr in blink::StyleRuleBase::createCSSOMWrapper. I stared at the code for a bit, and it seems like the this pointer must be null, which I don't really understand how that could happen...? Help?

Comment 4 by timloh@chromium.org, Oct 25 2016

You could try bisecting manually, it repros for me on Dev on Linux

<style>@namespace a "a"; div { }</style>
<style>@namespace a "a"; div { }</style>
<script>
document.styleSheets[0].deleteRule(1);
document.styleSheets[0].cssRules[0];
</script>
That test is so simple I don't think it's worth bisecting, just try to fix that test case. :)

Comment 6 by meade@chromium.org, Oct 25 2016

Cc: -meade@chromium.org esprehn@chromium.org
Owner: meade@chromium.org
oh, I see. I'll take a look.

Comment 7 by meade@chromium.org, Oct 28 2016

Cc: -timloh@chromium.org meade@chromium.org
Owner: timloh@chromium.org
Hey Tim, I still wasn't able to find the cause of this. I mucked around in gdb for a while, and eventually discovered two weird things

In the first (and should be only?) wrapperDeleteRule, m_namespaceRules[0].get() is already null.
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/css/StyleSheetContents.cpp?l=279

If I then break inside ruleAt, the behaviour of m_namespaceRules in gdb is weird: I can use the [] operator on m_childRules, but not m_namespaceRules...
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/css/StyleSheetContents.cpp?l=187

Any ideas?

Comment 8 by timloh@chromium.org, Oct 28 2016

I guess this is because StyleSheetContents::StyleSheetContents(const StyleSheetContents& o) isn't copying namespace rules.

Comment 9 by timloh@chromium.org, Oct 31 2016

Cc: nyerramilli@chromium.org ramy...@samsung.com
 Issue 660637  has been merged into this issue.
Cc: -meade@chromium.org timloh@chromium.org
Owner: meade@chromium.org
Status: Fixed (was: Assigned)
Project Member

Comment 12 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment