New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 658529 link

Starred by 1 user
Status: WontFix
Owner: ----
Closed: Dec 12
Cc:
rtoy@chromium.org
█ jwalc...@opera.com
█ msrchandra@chromium.org
rmcilroy@chromium.org
Components:
EstimatedDays: ----
NextAction: 2018-08-31
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

result || flags & PartitionAllocReturnNull in PartitionAlloc.h

Project Member Reported by ClusterFuzz, Oct 22 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5963465186607104

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_asan_chrome_v8_arm_ignition
Platform Id: linux

Crash Type: Security CHECK failure
Crash Address: 
Crash State:
  result || flags & PartitionAllocReturnNull in PartitionAlloc.h
  blink::AudioBuffer::createFloat32ArrayOrNull
  blink::AudioBuffer::AudioBuffer
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm_ignition&range=414680:414692

Minimized Testcase (0.23 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv957DHljS2J48kVr8pbcntHvAZwiOsHi9MKIUoLPK3OUqLyGer_PT_tp6s7Or7j0bAbzUGPYV_2KnPvDO3XBYa2Td_dhOowiKa62iFCjZ7Lvft52WKuYm4xvMq4LsYEVnIxlzKQF4IO0zDw51UZCww7BKhbsuA?testcase_id=5963465186607104
<script>
var renderLengthInFrames = 1073741823;
function createBuffer() {
}
function runJSNodeTest()
{
    context = new OfflineAudioContext(2, renderLengthInFrames, sampleRate);
}
var sampleRate = 44100.0;
runJSNodeTest();
</script>


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by msrchandra@chromium.org, Nov 10 2016

Cc: msrchandra@chromium.org
Components: Blink>Media>Audio
Labels: Test-Predator-Wrong
Owner: jwalc...@opera.com
Status: Assigned (was: Untriaged)
Find it did not find any possible suspects,
Suspected CLs	Findit failed to find any stack trace. Is it in a new format?

Assigning to the concern owner from the regressed CL --
https://chromium.googlesource.com/chromium/src/+log/870cd879882b00d61a19b5ae006df3f8ab241cf3..05b0a5fde57d6643daae59991fed16be7ca0ccf3?pretty=fuller

Suspecting Commit# a5cd9c49bcb56a12f04555cc218c4a940a579a4e
Suspecting Review URL#  https://codereview.chromium.org/2273203003

@jwalczak -- Could you please look into the issue, kindly re-assign if it is not related to any of your changes.
Thank You.

Comment 2 by jwalc...@opera.com, Nov 14 2016 

I think the issue might be related to  https://crbug.com/617628
Project Member

Comment 3 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 4 by mlamouri@chromium.org, Jun 19 2017

Cc: jwalc...@opera.com rtoy@chromium.org
Components: -Blink>Media>Audio Blink>WebAudio
Owner: ----
Status: Available (was: Assigned)
Dropping owner as they have not been active for more than a month.
+rtoy@ as it seems like a Web Audio issue.

Comment 5 by rtoy@chromium.org, Jun 21 2017 

The test case is allocating 1073741823 frames of data.  Each frame consists of a 2 channels of float data, so that's about 2 GB of data requested.

Isn't this just an ordinary OOM situation?

Comment 6 by hongchan@chromium.org, Apr 2 2018 

rtoy@

What should we do about this? WAI or WontFix?

Comment 7 by hongchan@chromium.org, Aug 27

Labels: -Test-Predator-Wrong
NextAction: 2018-08-31
Bump: if the comment #5 is correct, can we close this issue as WontFix?

Comment 8 by monor...@bugs.chromium.org, Aug 31 

The NextAction date has arrived: 2018-08-31

Comment 9 by hongchan@chromium.org, Dec 12

Status: WontFix (was: Available)
The current version 73.0.3638.0 does not cause problem anymore:

// No crash after this.
const context = new OfflineAudioContext(2, 1073741823, 48000)

// we get rejected promise after this call.
context.startRendering();

I am closing this issue as WontFix because it is irrelevant/obsolete now.
►

Sign in to add a comment