Crash in v8::internal::GlobalHandles::MakeWeak |
||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5969459266453504 Fuzzer: ifratric-browserfuzzer-v3 Job Type: mac_asan_chrome Platform Id: mac Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: v8::internal::GlobalHandles::MakeWeak blink::ScriptWrappable::setWrapper blink::V8DOMWrapper::associateObjectWithWrapper Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=409589:409828 Minimized Testcase (0.37 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96XX68NXlSTTrSbFcKOeZfXHR35mTqKQolZlaLQcieH-5rfrzyBsgLHYpj0C8P_hPY00xspqt1nMHSoIkelMcOY4mm7FdPV14H6uVHBJaEtsEKuo_sM_H5OLlAvv169vR9FCowsV-PLqlWsw1NQcRlzznv6zA?testcase_id=5969459266453504 <script> var fakestring = {toString: function() { /* Dictionary*/ var var00058 = { "patternUnits": [fakestring] }; /* Animation*/ var var00057 = htmlvar00001.animate(var00058); return "1" }} function jsfuzzer() { /* HTMLInputElement*/ var var00019 = document.createElement("input"); var00019.width = fakestring; } </script> <body onload=jsfuzzer()<a id="htmlvar00001"</a> Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Mar 10 2017
ClusterFuzz has detected this issue as fixed in range 456043:456056. Detailed report: https://clusterfuzz.com/testcase?key=5969459266453504 Fuzzer: ifratric-browserfuzzer-v3 Job Type: mac_asan_chrome Platform Id: mac Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: v8::internal::GlobalHandles::MakeWeak blink::ScriptWrappable::setWrapper blink::V8DOMWrapper::associateObjectWithWrapper Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=409589:409828 Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=456043:456056 Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96XX68NXlSTTrSbFcKOeZfXHR35mTqKQolZlaLQcieH-5rfrzyBsgLHYpj0C8P_hPY00xspqt1nMHSoIkelMcOY4mm7FdPV14H6uVHBJaEtsEKuo_sM_H5OLlAvv169vR9FCowsV-PLqlWsw1NQcRlzznv6zA?testcase_id=5969459266453504 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Mar 10 2017
ClusterFuzz testcase 5969459266453504 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||
►
Sign in to add a comment |
||
Comment 1 by rsesek@chromium.org
, Jan 6 2017Labels: -OS-Mac OS-All
Owner: haraken@chromium.org
Status: Assigned (was: Untriaged)