Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6608146023055360 Fuzzer: inferno_twister Job Type: linux_asan_chrome_mp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000034 Crash State: blink::RootInlineBox::ascentAndDescentForBox blink::InlineFlowBox::computeLogicalBoxHeights blink::RootInlineBox::alignBoxesInBlockDirection Sanitizer: address (ASAN) Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=172836:173286 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95QWgKnhnSmlVZiNvZGn7AMiqgvxuk2ECsvo_HlHdYrR67yzmJ0dEMSHg2jVoFeNcuShSVGXPteFMFnKVC1ij18PlwyBxYFbl6owSJYTzhNMH52WnH3-UaRVxYzOBZMRVb8TtXtaw_O2eNeW3byCdWc0ADUBxdJ1n_UnIbeHUpotbfSdcJV6qZSW_yh-AQQcKm44zm-A6PyZU31izUydITdg7Y6L8MaQP0-lgcWZeSsqHp-tk6uThXDJ8oW1MDAPN33peJ5uMAsM70oXLfgohm_T-Gg-zPvmGDEgfsB0CjVmyO-YNfq0AK6VkdWKaw63z1ZJsiIeNw2aGpdv3qRDYTuazgqQIZDo3QvCs4kxSbDqtlbD0k?testcase_id=6608146023055360 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
As per issue 664851 , assigning to eae@. could you please take a look?
Picking up in canary channel on android. https://crash.corp.google.com/browse?q=product.name%3D%27Chrome_Android%27%20AND%20product.version%3D%2758.0.2999.0%27%20AND%20custom_data.ChromeCrashProto.ptype%3D%27renderer%27%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D%27blink%3A%3ARootInlineBox%3A%3AascentAndDescentForBox%27&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D
mummareddy: Please do not assign bugs directly to engineers, leaving them as untriaged will allow them to picked up a lot quicker.
Sure, thank you.
ClusterFuzz has detected this issue as fixed in range 455091:455394. Detailed report: https://clusterfuzz.com/testcase?key=6608146023055360 Fuzzer: inferno_twister Job Type: linux_asan_chrome_mp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000034 Crash State: blink::RootInlineBox::ascentAndDescentForBox blink::InlineFlowBox::computeLogicalBoxHeights blink::RootInlineBox::alignBoxesInBlockDirection Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=172836:173286 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=455091:455394 Reproducer Testcase: https://clusterfuzz.com/download/AMIfv95QWgKnhnSmlVZiNvZGn7AMiqgvxuk2ECsvo_HlHdYrR67yzmJ0dEMSHg2jVoFeNcuShSVGXPteFMFnKVC1ij18PlwyBxYFbl6owSJYTzhNMH52WnH3-UaRVxYzOBZMRVb8TtXtaw_O2eNeW3byCdWc0ADUBxdJ1n_UnIbeHUpotbfSdcJV6qZSW_yh-AQQcKm44zm-A6PyZU31izUydITdg7Y6L8MaQP0-lgcWZeSsqHp-tk6uThXDJ8oW1MDAPN33peJ5uMAsM70oXLfgohm_T-Gg-zPvmGDEgfsB0CjVmyO-YNfq0AK6VkdWKaw63z1ZJsiIeNw2aGpdv3qRDYTuazgqQIZDo3QvCs4kxSbDqtlbD0k?testcase_id=6608146023055360 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Comment 1 by mummare...@chromium.org
, Jan 27 2017Labels: Test-Predator-Wrong M-58
Owner: e...@chromium.org
Status: Assigned (was: Untriaged)