Issue metadata
Sign in to add a comment
|
Crash in blink::FrameHost::globalRootScrollerController |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5032473923944448 Fuzzer: ifratric-browserfuzzer-v3 Job Type: mac_asan_chrome Platform Id: mac Crash Type: UNKNOWN READ Crash Address: 0x000000000038 Crash State: blink::FrameHost::globalRootScrollerController blink::FrameView::dispose blink::HTMLFrameOwnerElement::UpdateSuspendScope::performDeferredWidgetTreeOpera Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=436692:436770 Minimized Testcase (1.70 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96XDr-p6sFbjgnHLc2nQKzmcBV-3qq3pRiJKCAj9KKwOhNt_gi0f9dEsBjYOrpVwvF3YdRELpdvXyT2pJYcEU7q1jMOaF9VdT5AaqDC1JyylvyQk4hglPfRLSL5z8jbZ-K41OSUnJXyaVJO7yu3DrqQ9XsA5Q?testcase_id=5032473923944448 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Dec 21 2016
Assigning to the concern owner from find it results -- The result is a list of CLs that change the crashed files. Author: bokan Project: chromium Changelist: https://chromium.googlesource.com/chromium/src/+/cc87319620d224e62ae3aac4f1c027f5afd7e392 Time: Tue Dec 06 21:12:30 2016 Lines 332-335 of file FrameView.cpp which potentially caused crash are changed in this cl (frame #2, "blink::FrameView::dispose"). Minimum distance from crash line to modified line: 0. (file: FrameView.cpp, crashed on: 332, modified: 332). @bokan -- Could you please look into the issue, kindly re-assign if this is not related to your changes. Thank You.
,
Dec 21 2016
,
Dec 24 2016
ClusterFuzz has detected this issue as fixed in range 438498:440663. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5032473923944448 Fuzzer: ifratric-browserfuzzer-v3 Job Type: mac_asan_chrome Platform Id: mac Crash Type: UNKNOWN READ Crash Address: 0x000000000038 Crash State: blink::FrameHost::globalRootScrollerController blink::FrameView::dispose blink::HTMLFrameOwnerElement::UpdateSuspendScope::performDeferredWidgetTreeOpera Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=436692:436770 Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=438498:440663 Minimized Testcase (1.70 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96XDr-p6sFbjgnHLc2nQKzmcBV-3qq3pRiJKCAj9KKwOhNt_gi0f9dEsBjYOrpVwvF3YdRELpdvXyT2pJYcEU7q1jMOaF9VdT5AaqDC1JyylvyQk4hglPfRLSL5z8jbZ-K41OSUnJXyaVJO7yu3DrqQ9XsA5Q?testcase_id=5032473923944448 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by patricia...@chromium.org
, Dec 19 2016