New issue
Advanced search Search tips

Issue 677673 link

Starred by 2 users

Issue metadata

Status: Duplicate
Merged: issue 678927
Owner: ----
Closed: Jan 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug



Sign in to add a comment

Crash in blink::WebFrame::getSecurityOrigin

Project Member Reported by ClusterFuzz, Dec 30 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5023393540997120

Fuzzer: inferno_twister_custom_bundle
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000003
Crash State:
  blink::WebFrame::getSecurityOrigin
  content::GetAudioHardwareParams
  content::RendererBlinkPlatformImpl::audioHardwareSampleRate
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=440981:441002

Minimized Testcase (0.28 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv971Dpe8r83HVG7cjnWklwM4RU8aamFph49Da4B21UAD8rOSvcv9E9dU_PjR6yty_Ky1SqqlWjLoC7vc0qx1jlOvmQ3huCzCrkYABN0rHSxJSTsGlfpmTI3ov4hOmidEAK0U6DEWK5dxfV8lfvyEx7MC3T1B_0R9Req0tWGaIUWwoJXGBKobX0cvYlO6xChab5FoLldaZrZ2XoGzVO-7bCM42pNWqeI9FUStwusOA0AYRC6p_qRODQImFwY_cRHcq9jh0sKx_dWWFEulNwm1TGGgKAdm2E_M1oUFb-LkXMjaYCGznDWIilHI0W2G-PYjUnDgCntRNu_qQwzNWXJLPLdTpND-mX0ILZ1-3Sz6rg1GbkhsrbI?testcase_id=5023393540997120
><script>
  var iframe = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
  document.body.appendChild(iframe);
  var frameWin = iframe.contentWindow;
  new frameWin.AudioContext();
  document.body.removeChild(iframe);
  new frameWin.AudioContext();
</script>


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Components: Blink>Media>Audio

Comment 2 by sigbjo...@opera.com, Jan 11 2017

Mergedinto: 678927
Status: Duplicate (was: Untriaged)
Project Member

Comment 3 by ClusterFuzz, Jan 17 2017

ClusterFuzz has detected this issue as fixed in range 443594:443650.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5023393540997120

Fuzzer: inferno_twister_custom_bundle
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000003
Crash State:
  blink::WebFrame::getSecurityOrigin
  content::GetAudioHardwareParams
  content::RendererBlinkPlatformImpl::audioHardwareSampleRate
  
Memory Tool: SYZYASAN

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=440981:441002
Fixed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=443594:443650

Minimized Testcase (0.28 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv971Dpe8r83HVG7cjnWklwM4RU8aamFph49Da4B21UAD8rOSvcv9E9dU_PjR6yty_Ky1SqqlWjLoC7vc0qx1jlOvmQ3huCzCrkYABN0rHSxJSTsGlfpmTI3ov4hOmidEAK0U6DEWK5dxfV8lfvyEx7MC3T1B_0R9Req0tWGaIUWwoJXGBKobX0cvYlO6xChab5FoLldaZrZ2XoGzVO-7bCM42pNWqeI9FUStwusOA0AYRC6p_qRODQImFwY_cRHcq9jh0sKx_dWWFEulNwm1TGGgKAdm2E_M1oUFb-LkXMjaYCGznDWIilHI0W2G-PYjUnDgCntRNu_qQwzNWXJLPLdTpND-mX0ILZ1-3Sz6rg1GbkhsrbI?testcase_id=5023393540997120
><script>
  var iframe = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
  document.body.appendChild(iframe);
  var frameWin = iframe.contentWindow;
  new frameWin.AudioContext();
  document.body.removeChild(iframe);
  new frameWin.AudioContext();
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment