New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 670258 link

Starred by 1 user
Status: Verified
Owner:
yosin@chromium.org
Closed: Dec 2016
Cc:
ifratric@google.com
█ msrchandra@chromium.org
editing-dev@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac
Pri: 1
Type: Bug



Sign in to add a comment

toPositionInFlatTree() should support isActiveSlotOrActiveInsertionPoint()

Project Member Reported by ClusterFuzz, Dec 1 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5250016768950272

Fuzzer: ifratric-browserfuzzer-v3
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  blink::editingIgnoresContent
  blink::PositionIteratorAlgorithm<blink::EditingAlgorithm<blink::FlatTreeTraversa
  blink::mostBackwardCaretPosition
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=370873:370888

Minimized Testcase (1.45 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96kulF67_zdo510olPZ3QtI6RC18cp-xDkutQ3Ct5RU1XUWMY0ujgfYpybOeC_c4MLE_xbBcXXljfgNdQgFikVagSF43S1J6fFZrRiotaeun-r268cKigCyL_1MYrvvK8UEpcWpviVPPyoa5Ar14h4TSIcfpg?testcase_id=5250016768950272

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by msrchandra@chromium.org, Dec 1 2016

Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong-CLs
Owner: yosin@chromium.org
Status: Assigned (was: Untriaged)
Unable to find the possible suspect using Find it and CL.
From Code Search for the file, "EditingStrategy.cpp" assigning to the concern owner.
Suspecting the Commit# 
https://chromium.googlesource.com/chromium/src/+/4718105a56141fb39a6be72f6d44e355c5e44d02

@yosin -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by yosin@chromium.org, Dec 2 2016 

DOM tree at assertion:

m_selection.showTreeForThis()
[14124:54300:1202/155614.901:1981011609:INFO:visibleselection.cpp(785)] 
BODY
	#text "\n"
	CONTENT id="htmlvar00001"
		#text "\n"
		DIV id="htmlvar00004"
			#text "\n"
			KEYGEN id="htmlvar00006" style="-webkit-user-modify: read-write-plaintext-only;" (editable)
				#shadow-root
					SELECT
						#shadow-root
							CONTENT
						OPTION
							#shadow-root
								#text "2048 (High Grade)"
							#text "2048 (High Grade)"
						OPTION
							#shadow-root
								#text "1024 (Medium Grade)"
							#text "1024 (Medium Grade)"
			#text "\n"
			VIDEO id="htmlvar00008"
				#shadow-root
					DIV
						DIV
							INPUT style="display: none;"
								#shadow-root
									#text ""
						DIV
							DIV style="display: none;"
								INPUT style="display: none;"
									#shadow-root
										#text ""
								DIV style="display: none;"
									#text "0:00"
								DIV style="display: none;"
									#text "/ 0:00"
								INPUT style="display: none;"
									#shadow-root
										DIV style="-webkit-appearance:inherit"
											DIV id="track"
												DIV id="thumb"
								INPUT style="display: none;"
									#shadow-root
										#text ""
								INPUT style="display: none;"
									#shadow-root
										DIV style="-webkit-appearance:inherit"
											DIV id="track"
												DIV id="thumb"
								INPUT style="display: none;"
									#shadow-root
										#text ""
								INPUT style="display: none;"
									#shadow-root
										#text ""
								INPUT style="display: none;"
									#shadow-root
										#text ""
								INPUT style="display: none;"
									#shadow-root
										#text ""
								INPUT style="display: none;"
									#shadow-root
										#text ""
						DIV style="display: none;"
						DIV style="display: none;"
							LABEL
								INPUT style="display: none;"
									#shadow-root
										#text ""
								#text "Play"
							LABEL
								INPUT style="display: none;"
									#shadow-root
										#text ""
								#text "Fullscreen"
							LABEL
								INPUT style="display: none;"
									#shadow-root
										#text ""
								#text "Download"
							LABEL
								INPUT style="display: none;"
									#shadow-root
										#text ""
								#text "Mute"
							LABEL
								INPUT style="display: none;"
									#shadow-root
										#text ""
								#text "Cast"
							LABEL
								INPUT style="display: none;"
									#shadow-root
										#text ""
								#text "Captions"
			#text "\n"
			OL id="htmlvar00010"
				#shadow-root
S					CONTENT id="htmlvar00001"
						#text "\n"
						DIV id="htmlvar00004"
							#text "\n"
E							KEYGEN id="htmlvar00006" style="-webkit-user-modify: read-write-plaintext-only;" (editable) (focused)
E								#shadow-root
E									SELECT
E										#shadow-root
E											CONTENT
E										OPTION
E											#shadow-root
E												#text "2048 (High Grade)"
E											#text "2048 (High Grade)"
E										OPTION
E											#shadow-root
E												#text "1024 (Medium Grade)"
E											#text "1024 (Medium Grade)"
							#text "\n"
							VIDEO id="htmlvar00008"
								#shadow-root
									DIV
										DIV
											INPUT style="display: none;"
												#shadow-root
													#text ""
										DIV
											DIV style="display: none;"
												INPUT style="display: none;"
													#shadow-root
														#text ""
												DIV style="display: none;"
													#text "0:00"
												DIV style="display: none;"
													#text "/ 0:00"
												INPUT style="display: none;"
													#shadow-root
														DIV style="-webkit-appearance:inherit"
															DIV id="track"
																DIV id="thumb"
												INPUT style="display: none;"
													#shadow-root
														#text ""
												INPUT style="display: none;"
													#shadow-root
														DIV style="-webkit-appearance:inherit"
															DIV id="track"
																DIV id="thumb"
												INPUT style="display: none;"
													#shadow-root
														#text ""
												INPUT style="display: none;"
													#shadow-root
														#text ""
												INPUT style="display: none;"
													#shadow-root
														#text ""
												INPUT style="display: none;"
													#shadow-root
														#text ""
												INPUT style="display: none;"
													#shadow-root
														#text ""
										DIV style="display: none;"
										DIV style="display: none;"
											LABEL
												INPUT style="display: none;"
													#shadow-root
														#text ""
												#text "Play"
											LABEL
												INPUT style="display: none;"
													#shadow-root
														#text ""
												#text "Fullscreen"
											LABEL
												INPUT style="display: none;"
													#shadow-root
														#text ""
												#text "Download"
											LABEL
												INPUT style="display: none;"
													#shadow-root
														#text ""
												#text "Mute"
											LABEL
												INPUT style="display: none;"
													#shadow-root
														#text ""
												#text "Cast"
											LABEL
												INPUT style="display: none;"
													#shadow-root
														#text ""
												#text "Captions"
							#text "\n"
							OL id="htmlvar00010"
								#text "\n"
								AUDIO id="htmlvar00021"
									#shadow-root
										DIV
											DIV
												INPUT style="display: none;"
													#shadow-root
														#text ""
											DIV
												DIV style="display: none;"
													INPUT style="display: none;"
														#shadow-root
															#text ""
													DIV style="display: none;"
														#text "0:00"
													DIV style="display: none;"
														#text "/ 0:00"
													INPUT style="display: none;"
														#shadow-root
															DIV style="-webkit-appearance:inherit"
																DIV id="track"
																	DIV id="thumb"
													INPUT style="display: none;"
														#shadow-root
															#text ""
													INPUT style="display: none;"
														#shadow-root
															DIV style="-webkit-appearance:inherit"
																DIV id="track"
																	DIV id="thumb"
													INPUT style="display: none;"
														#shadow-root
															#text ""
													INPUT style="display: none;"
														#shadow-root
															#text ""
													INPUT style="display: none;"
														#shadow-root
															#text ""
													INPUT style="display: none;"
														#shadow-root
															#text ""
													INPUT style="display: none;"
														#shadow-root
															#text ""
											DIV style="display: none;"
											DIV style="display: none;"
												LABEL
													INPUT style="display: none;"
														#shadow-root
															#text ""
													#text "Play"
												LABEL
													INPUT style="display: none;"
														#shadow-root
															#text ""
													#text "Fullscreen"
												LABEL
													INPUT style="display: none;"
														#shadow-root
															#text ""
													#text "Download"
												LABEL
													INPUT style="display: none;"
														#shadow-root
															#text ""
													#text "Mute"
												LABEL
													INPUT style="display: none;"
														#shadow-root
															#text ""
													#text "Cast"
												LABEL
													INPUT style="display: none;"
														#shadow-root
															#text ""
													#text "Captions"
									#text "\n"
									KEYGEN id="htmlvar00026"
										#shadow-root
											SELECT
												#shadow-root
													CONTENT
												OPTION
													#shadow-root
														#text "2048 (High Grade)"
													#text "2048 (High Grade)"
												OPTION
													#shadow-root
														#text "1024 (Medium Grade)"
													#text "1024 (Medium Grade)"
				#text "\n"
				AUDIO id="htmlvar00021"
					#shadow-root
						DIV
							DIV
								INPUT style="display: none;"
									#shadow-root
										#text ""
							DIV
								DIV style="display: none;"
									INPUT style="display: none;"
										#shadow-root
											#text ""
									DIV style="display: none;"
										#text "0:00"
									DIV style="display: none;"
										#text "/ 0:00"
									INPUT style="display: none;"
										#shadow-root
											DIV style="-webkit-appearance:inherit"
												DIV id="track"
													DIV id="thumb"
									INPUT style="display: none;"
										#shadow-root
											#text ""
									INPUT style="display: none;"
										#shadow-root
											DIV style="-webkit-appearance:inherit"
												DIV id="track"
													DIV id="thumb"
									INPUT style="display: none;"
										#shadow-root
											#text ""
									INPUT style="display: none;"
										#shadow-root
											#text ""
									INPUT style="display: none;"
										#shadow-root
											#text ""
									INPUT style="display: none;"
										#shadow-root
											#text ""
									INPUT style="display: none;"
										#shadow-root
											#text ""
							DIV style="display: none;"
							DIV style="display: none;"
								LABEL
									INPUT style="display: none;"
										#shadow-root
											#text ""
									#text "Play"
								LABEL
									INPUT style="display: none;"
										#shadow-root
											#text ""
									#text "Fullscreen"
								LABEL
									INPUT style="display: none;"
										#shadow-root
											#text ""
									#text "Download"
								LABEL
									INPUT style="display: none;"
										#shadow-root
											#text ""
									#text "Mute"
								LABEL
									INPUT style="display: none;"
										#shadow-root
											#text ""
									#text "Cast"
								LABEL
									INPUT style="display: none;"
										#shadow-root
											#text ""
									#text "Captions"
					#text "\n"
					KEYGEN id="htmlvar00026"
						#shadow-root
							SELECT
								#shadow-root
									CONTENT
								OPTION
									#shadow-root
										#text "2048 (High Grade)"
									#text "2048 (High Grade)"
								OPTION
									#shadow-root
										#text "1024 (Medium Grade)"
									#text "1024 (Medium Grade)"
start: offsetInAnchor[0]
end: beforeAnchor
<void>

Comment 3 by yosin@chromium.org, Dec 2 2016

Components: Blink>Editing>Selection
Labels: OS-Android OS-Chrome OS-Linux OS-Windows
Owner: ----
Status: Available (was: Assigned)
Summary: toPositionInFlatTree() should support isActiveSlotOrActiveInsertionPoint() (was: Crash in blink::editingIgnoresContent)
We

Comment 4 by yosin@chromium.org, Dec 2 2016

Owner: yosin@chromium.org
Status: Started (was: Available)
In review: http://crrev.com/670258
Project Member

Comment 5 by ClusterFuzz, Dec 24 2016 

ClusterFuzz has detected this issue as fixed in range 438498:440663.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5250016768950272

Fuzzer: ifratric-browserfuzzer-v3
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  blink::editingIgnoresContent
  blink::PositionIteratorAlgorithm<blink::EditingAlgorithm<blink::FlatTreeTraversa
  blink::mostBackwardCaretPosition
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=370873:370888
Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=438498:440663

Minimized Testcase (1.45 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96kulF67_zdo510olPZ3QtI6RC18cp-xDkutQ3Ct5RU1XUWMY0ujgfYpybOeC_c4MLE_xbBcXXljfgNdQgFikVagSF43S1J6fFZrRiotaeun-r268cKigCyL_1MYrvvK8UEpcWpviVPPyoa5Ar14h4TSIcfpg?testcase_id=5250016768950272

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Dec 24 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 5250016768950272 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
►

Sign in to add a comment