New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 664744 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Nov 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in base::debug::DebugBreak

Project Member Reported by ClusterFuzz, Nov 12 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5098280683044864

Fuzzer: libfuzzer_html_preload_scanner_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e9000065a2
Crash State:
  base::debug::DebugBreak
  blink::LinkLoader::getResourceTypeFromAsAttribute
  blink::TokenPreloadScanner::StartTagScanner::resourceType
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=416298:416360

Minimized Testcase (6.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95GMDYK-6RTi2n7qORoT2DNP8mHxsrYH7PqZaBqSG8unSlKdY0AW1Sw-9scLtyVCyGCG7OaCGtk0OOs3S8bPZ5_27py7PjlAWTzYn5Qs9OMehW5HOzFJwtXNaHh-6u1eSxF1BQGZZ8c8Judh9ewgzAi5HZIYw?testcase_id=5098280683044864

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Components: Infra>Git
Labels: Test-Predator-Wrong-CLs
Owner: csharrison@chromium.org
Status: Assigned (was: Untriaged)
Find it did not provide any suspected CLs, below are the results,
Suspected CLs	Git blame below is NOT necessarily who introduced the crash nor the owner for it. Please check the code before assigning to anyone.(No CL in the regression range changed the crashing files.)

Author: mostynb@opera.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/901a5e3835718e8872f38af32d65fce7ea3fcbeb
Time: Mon Apr 08 23:26:25 2013
The CL last changed line 221 of file debugger_posix.cc, which is stack frame 2.

Author: brettw@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/58580359a452cb7c3b9580edc0843c3ab3d158df
Time: Tue Oct 26 04:07:50 2010
The CL last changed line 251 of file debugger_posix.cc, which is stack frame 3.

Author: rch@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/82d89abc03ea6fd6b9258f0e57be0290b33d7eb1
Time: Fri Feb 28 18:25:34 2014
The CL last changed line 748 of file logging.cc, which is stack frame 4.

Author: Blink Reformat
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1c8e1a7719e9d223cc84e838c9a31a0210f5878b
Time: Sat Oct 01 00:25:32 2016
The CL last changed line 187 of file LinkLoader.cpp, which is stack frame 5.

Author: Blink Reformat
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1c8e1a7719e9d223cc84e838c9a31a0210f5878b
Time: Sat Oct 01 00:25:32 2016
The CL last changed line 459 of file HTMLPreloadScanner.cpp, which is stack frame 6.

Suspected Project: chromium

From the regressed CL assigning to the possible suspect,

https://chromium.googlesource.com/chromium/src/+log/33b61506dfd38f489950612a88451ab680bfe431..758b11555d5e65c63258731d4fc72b7d7edea0d7?pretty=fuller

Suspect Commit# 8292c59774cac439c34c0692d22e321e2f6e8b18
Suspect Review URL# https://codereview.chromium.org/2261873002

@csharrison -- Could you please look into the issue, kindly re-assign if not related to your changes.
Thank You.
Definitely not related to my changes but I'll try to look into it anyways. I also wrote  this fuzzer.
Project Member

Comment 3 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by bugdroid1@chromium.org, Nov 29 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/50ccef041685519550b26723c1e6bec74b9f9fc3

commit 50ccef041685519550b26723c1e6bec74b9f9fc3
Author: csharrison <csharrison@chromium.org>
Date: Tue Nov 29 13:52:56 2016

Support as=<UPPERCASE VALUE> for link preloads in preload scanner

The LinkLoader code assumes all link preloads will have lowercased
'as' values. This is not the case for preloads coming in via the preload
scanner.

This patch fixes that issue and adds a unit test that reproduces this
failure.

BUG= 664744 

Review-Url: https://codereview.chromium.org/2496343002
Cr-Commit-Position: refs/heads/master@{#434978}

[modify] https://crrev.com/50ccef041685519550b26723c1e6bec74b9f9fc3/third_party/WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp
[modify] https://crrev.com/50ccef041685519550b26723c1e6bec74b9f9fc3/third_party/WebKit/Source/core/html/parser/HTMLPreloadScannerTest.cpp

Status: Fixed (was: Assigned)
Project Member

Comment 6 by ClusterFuzz, Nov 30 2016

ClusterFuzz has detected this issue as fixed in range 434974:435013.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5098280683044864

Fuzzer: libfuzzer_html_preload_scanner_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x03e9000065a2
Crash State:
  base::debug::DebugBreak
  blink::LinkLoader::getResourceTypeFromAsAttribute
  blink::TokenPreloadScanner::StartTagScanner::resourceType
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=416298:416360
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=434974:435013

Minimized Testcase (6.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95GMDYK-6RTi2n7qORoT2DNP8mHxsrYH7PqZaBqSG8unSlKdY0AW1Sw-9scLtyVCyGCG7OaCGtk0OOs3S8bPZ5_27py7PjlAWTzYn5Qs9OMehW5HOzFJwtXNaHh-6u1eSxF1BQGZZ8c8Judh9ewgzAi5HZIYw?testcase_id=5098280683044864

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment