New issue
Advanced search Search tips

Issue 658873 link

Starred by 1 user
Status: Fixed
Owner:
e...@chromium.org
Closed: Oct 2016
Cc:
style-bugs@google.com
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug



Sign in to add a comment

Crash in blink::SVGLengthContext::convertValueFromUserUnitsToEXS

Project Member Reported by ClusterFuzz, Oct 24 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6385243286405120

Fuzzer: inferno_twister
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000023
Crash State:
  blink::SVGLengthContext::convertValueFromUserUnitsToEXS
  blink::SVGLengthContext::convertValueFromUserUnits
  blink::SVGLength::convertToSpecifiedUnits
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=425517:425531

Minimized Testcase (2.07 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96_3ABf7M4FFkDJBsWsxVnz-1CQFyQiBAF8e_86htwqQi_SIhzDyE6ICW8oHqnSCsjIWM3w5GD7ITNHecWqsxHYDONoVs-KpyecGzVaYOfGXfM9Arc4mVcsQxyTQtYZOWQ9VdAkEn_d2pirmCxrTUbs0CqGhQ?testcase_id=6385243286405120

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by mummare...@chromium.org, Oct 24 2016

Components: Blink>CSS
Labels: M-56 Te-Logged
Owner: e...@chromium.org
Status: Assigned (was: Untriaged)
Author: eae
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/cbdb3af3db880d58d5e698dfcae88aae68b5682e
Time: Sat Oct 15 01:21:11 2016
File ComputedStyle.cpp is changed in this cl (and is part of stack frame #0, "chrome_child!blink::ComputedStyle::font")
Minimum distance from crash line to modified line: 71. (file: ComputedStyle.cpp, crashed on: 1646, modified: 1575).

Suspected Project: chromium
Suspected Component: Blink>CSS

Comment 2 by e...@chromium.org, Oct 24 2016

Status: Fixed (was: Assigned)
Project Member

Comment 3 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment