New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 668556 link

Starred by 2 users

Issue metadata

Status: Duplicate
Merged: issue 667036
Owner: ----
Closed: Nov 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Data race in blink::ImageDecoder::initFrameBuffer

Project Member Reported by ClusterFuzz, Nov 24 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6497922201157632

Fuzzer: ochang_domfuzzer
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 1
Crash Address: 0x7feca0b207f8
Crash State:
  blink::ImageDecoder::initFrameBuffer
  blink::GIFImageDecoder::haveDecodedRow
  GIFLZWContext::outputRow
  

Minimized Testcase (0.07 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95ygX8UcUKAatN19yR48YTxbDx1TuMwgfvlqS99rJJwqvkfN4X4_0MG1nJdj_OPp-NJoLXugfXmkuJVo8R2f607hX6gMumrtglsPAKLj9J70-J0aV-Y7d6Rl3g7U6ptBRfxRrO7VMpjAi96RxKotMZreR6fRA?testcase_id=6497922201157632
<meta content="0; url=http://natpa.com/" http-equiv="refresh"</head> {


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: msrchandra@chromium.org joostouwerling@google.com
Labels: Test-Predator-Wrong
Unable to find the possible suspect using Code Search and CL.
Assigning to the concern owner from Code Search using the file, "GIFImageDecoder.cpp".

Suspecting CL --
https://chromium.googlesource.com/chromium/src/+/1b922661248b6684779a874883c5bf30d73bf692

@joostouwerling -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by joedy....@gmail.com, Nov 25 2016

Pada tanggal 25 Nov 2016 22:20, "msrchan… via monorail" <
monorail+v2.3022387033@chromium.org> menulis:

blink::ImageDecoder::initFrameBuffer

"GIFImageDecoder.cpp".

https://chromium.googlesource.com/chromium/src/+/1b922661248b6684779a874883c5bf30d73bf692

if this is not related to your changes.
Mergedinto: 667036
Status: Duplicate (was: Untriaged)
Project Member

Comment 4 by ClusterFuzz, Dec 1 2016

ClusterFuzz has detected this issue as fixed in range 435416:435480.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6497922201157632

Fuzzer: ochang_domfuzzer
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 1
Crash Address: 0x7feca0b207f8
Crash State:
  blink::ImageDecoder::initFrameBuffer
  blink::GIFImageDecoder::haveDecodedRow
  GIFLZWContext::outputRow
  
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=435416:435480

Minimized Testcase (0.07 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95ygX8UcUKAatN19yR48YTxbDx1TuMwgfvlqS99rJJwqvkfN4X4_0MG1nJdj_OPp-NJoLXugfXmkuJVo8R2f607hX6gMumrtglsPAKLj9J70-J0aV-Y7d6Rl3g7U6ptBRfxRrO7VMpjAi96RxKotMZreR6fRA?testcase_id=6497922201157632
<meta content="0; url=http://natpa.com/" http-equiv="refresh"</head> {


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment