New issue
Advanced search Search tips

Issue 681460 link

Starred by 1 user
Status: Verified
Owner:
dmazz...@chromium.org
Closed: Mar 2017
Cc:
ifratric@google.com
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug
Team-Accessibility



Sign in to add a comment

!node.needsDistributionRecalc() in FlatTreeTraversal.h

Project Member Reported by ClusterFuzz, Jan 16 2017 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4673821937500160

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !node.needsDistributionRecalc() in FlatTreeTraversal.h
  blink::FlatTreeTraversal::assertPrecondition
  blink::FlatTreeTraversal::parent
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=325288:325413

Minimized Testcase (0.21 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97__HASW_jBdYrx7l0SHW9LD3YAS5YCqkX085KLttBA-7KoP4IEStSo1mSpPb5hOL_IHrHEoeppei8W2wPfQ9VelZti2ZkEfnYsg2F3YuNY-W_vuCS_qtfqK4O2oQiDQMyJaH5U35wQw_ajd2OsSagqr23OChtMyZw7x0s8n-CZrlFV8v8Br3-bEKC72gu2cfKPCpKKSyDILsvZ9dFAKJ85g1otbzORlEgNGO_9Xr82DFaLSyXae_gZtOmd1sJteMzsYfzqNcf6Dt5WitWbnPE8__bQLKdxPdxsvJ1OztfOmZkDt0mikh-BTbUIH9rBG0EnlmVJ-_anoRVxf1aB81gayUMKeXBcIEYvCEtNN5bf8aLicJg?testcase_id=4673821937500160
<script>
var htmlvar00030 = document.createElement("summary"); //HTMLUnknownElement
 /* Window*/ var var00006 = window.top; 
 /* CSSRuleList*/ var var00193 = var00006.getMatchedCSSRules(htmlvar00030); 
</script>


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by mummare...@chromium.org, Jan 19 2017

Components: UI>Accessibility
Labels: Test-Predator-Wrong M-56
Owner: dmazz...@chromium.org
Status: Assigned (was: Untriaged)
Based on the existing issue 664635, assigning to dmazzoni@. could you please take a look and help us to find correct owner if it is not related your changes.
Project Member

Comment 2 by ClusterFuzz, Mar 11 2017 

ClusterFuzz has detected this issue as fixed in range 455565:456161.

Detailed report: https://clusterfuzz.com/testcase?key=4673821937500160

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !node.needsDistributionRecalc() in FlatTreeTraversal.h
  blink::FlatTreeTraversal::assertPrecondition
  blink::FlatTreeTraversal::parent
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=325288:325413
Fixed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=455565:456161

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv97__HASW_jBdYrx7l0SHW9LD3YAS5YCqkX085KLttBA-7KoP4IEStSo1mSpPb5hOL_IHrHEoeppei8W2wPfQ9VelZti2ZkEfnYsg2F3YuNY-W_vuCS_qtfqK4O2oQiDQMyJaH5U35wQw_ajd2OsSagqr23OChtMyZw7x0s8n-CZrlFV8v8Br3-bEKC72gu2cfKPCpKKSyDILsvZ9dFAKJ85g1otbzORlEgNGO_9Xr82DFaLSyXae_gZtOmd1sJteMzsYfzqNcf6Dt5WitWbnPE8__bQLKdxPdxsvJ1OztfOmZkDt0mikh-BTbUIH9rBG0EnlmVJ-_anoRVxf1aB81gayUMKeXBcIEYvCEtNN5bf8aLicJg?testcase_id=4673821937500160


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 3 by ClusterFuzz, Mar 11 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4673821937500160 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
►

Sign in to add a comment