Crash in blink::RootInlineBox::ascentAndDescentForBox |
|||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5568519184056320 Fuzzer: ochang_domfuzzer Job Type: linux_asan_chrome_mp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000038 Crash State: blink::RootInlineBox::ascentAndDescentForBox blink::InlineFlowBox::computeLogicalBoxHeights blink::RootInlineBox::alignBoxesInBlockDirection Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=425380:425442 Minimized Testcase (1.70 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97n7OwciUlRVcXo9VYnbJhJj46L7L8PXoFl2psY9szefjjfgIwfy3u7zKVnk0ndu-dELD5Nd_K3fzsdoRgqYZnCONfMvXjApCZqmzeWTkxhlc0RU681_VC3titcqTtK7Sn-Mf6RtS2-ILA1dyYB4xIdkX6Tnw?testcase_id=5568519184056320 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Nov 1 2016
I hit a v8 error when trying to repro locally with an asan build. # Fatal error in ../../v8/src/snapshot/snapshot.h, line 28 # Check failed: IsSane(). Please advice.
,
Nov 1 2016
please assigned this to appropriate owner if possible. Thank you
,
Nov 1 2016
I assigned it back to you as requested in comment 1 due to a problem reproducing it (as outlined in comment 2). If you can't help then please close the bug as WontFix. Thanks!
,
Nov 2 2016
,
Nov 7 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by mmohammad@chromium.org
, Oct 27 2016Status: Assigned (was: Untriaged)