content CSS property and -webkit-mask-image breaks insertOrderedList command |
||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6120160663699456 Fuzzer: ifratric-browserfuzzer-v3 Job Type: mac_asan_chrome Platform Id: mac Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: blink::FlatTreeTraversal::traverseParent blink::PositionIteratorAlgorithm<blink::EditingAlgorithm<blink::FlatTreeTraversa blink::mostBackwardCaretPosition Sanitizer: address (ASAN) Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=408575:408586 Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97dwReBHCnx4cFQjQVKepdfEyHdQo4dhuZWHduhuVLsU0ZmdKJ69u-WbUoJW9WWb6WtW4xpeFUU6uy_3G6QXx-LANbqs8MEbWof5jEUKfOU2TFNBJKEsVWCM1OjSvbcvLRJpEQBoS7dFziTrIh23-2wSNaL4yvea7CDW4Vm62K99Vj39cDwyEeCHerdcz8veggHd4EFphGbb1iFHVG5mB_2YV6LqVdD_pzFV95LInZb6KE3dM6XcXdAz40K1K63Kkdz8zPCjjaBqC8NGs7G7JP9RK-JpHnbExUEGwCANik8ugIvzE66tEHhLRHaD5-brdUtHv7OtAsG3Erh11GFI_n7Y-_LuZdwdGtsrcM4vz_9-xGdrmGO8RVLWyOB9z3Z4BdDvNjyZ29ivBd46Fg_4JezMF4Elw?testcase_id=6120160663699456 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Feb 3 2017
Predator and CL did not find any possible suspects. Using Code Search for the file, "FlatTreeTraversal.cpp" assigning to the concern owner. @hayato -- Could you please look into the issue, kindly re-assign if this is not related to your changes. Thank You.
,
Feb 6 2017
yosin@ Yet another FlatTreeTraversal bug is coming, involving Editing! Could you take a look? If you need my help, please feel free to re-assign to me.
,
Feb 6 2017
Hit DCHECK(m_selectionInFlatTree.isValidFor(document())) << m_selection; in SelectionEditor::updateIfNeeded() SelectionEditor::m_selection is null, but m_selectionInFlatTree is BeforeAnchor, SELECT (not connected) BODY id="htmlvar00021" #text "\n" LI id="htmlvar00022" style="content: url(\"data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7\");" #text "\n" FORM id="htmlvar00042" #text "\n" TEXTAREA #shadow-root DIV id="inner-editor" #text "\n" #text "\n" SE SELECT id="htmlvar00089" SE #shadow-root SE CONTENT #text "\n" start: beforeAnchor end: beforeAnchor blink::SelectionEditor::updateIfNeeded() Line 163 blink::FrameSelection::updateIfNeeded() Line 1396 blink::enabledInRichlyEditableText(blink::LocalFrame & frame, blink::Event * __formal, blink::EditorCommandSource __formal) Line 1903 blink::Editor::Command::isEnabled(blink::Event * triggeringEvent) Line 2683 blink::Editor::Command::execute(const WTF::String & parameter, blink::Event * triggeringEvent) Line 2633 blink::Document::execCommand(const WTF::String & commandName, bool __formal, const WTF::String & value, blink::ExceptionState & exceptionState) Line 91 blink::DocumentV8Internal::execCommandMethod(const v8::FunctionCallbackInfo<v8::Value> & info) Line 3194 blink::V8Document::execCommandMethodCallback(const v8::FunctionCallbackInfo<v8::Value> & info) Line 5338 v8.dll!v8::internal::FunctionCallbackArguments::Call(void(*)(const v8::FunctionCallbackInfo<v8::Value> &) f) Line 26 v8.dll!v8::internal::`anonymous namespace'::HandleApiCallHelper<0>(v8::internal::Isolate * isolate, v8::internal::Handle<v8::internal::HeapObject> function, v8::internal::Handle<v8::internal::HeapObject> new_target, v8::internal::Handle<v8::internal::FunctionTemplateInfo> fun_data, v8::internal::Handle<v8::internal::Object> receiver, v8::internal::BuiltinArguments args) Line 108 v8.dll!v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments args, v8::internal::Isolate * isolate) Line 135
,
Feb 6 2017
Lower to Pri-2 since real world usage of insertOrderedListCommand with -webkit-mask-image is low.
The root cause is "insertOrderedList" commands set selectionInDOMTree to null and selectionInFlatTree to BeforeAnchor, SELECT.
This prevents to update selecitonInFlatTree at BODY node removal by |document.body.replaceWith()|
Here is minimized script:
<script>
window.onload = function() {
document.querySelector('li').style.setProperty('content', 'url(data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7)');
document.execCommand("insertOrderedList");
document.body.replaceWith();
document.execCommand("strikeThrough");
};
</script>
<body>
<li><form><textarea autofocus></textarea></form></li>
<select><option style="-webkit-mask-image: url(#foo);"></option></select>
,
Feb 15 2017
ClusterFuzz has detected this issue as fixed in range 450347:450401. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6120160663699456 Fuzzer: ifratric-browserfuzzer-v3 Job Type: mac_asan_chrome Platform Id: mac Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: blink::FlatTreeTraversal::traverseParent blink::PositionIteratorAlgorithm<blink::EditingAlgorithm<blink::FlatTreeTraversa blink::mostBackwardCaretPosition Sanitizer: address (ASAN) Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=408575:408586 Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=450347:450401 Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97dwReBHCnx4cFQjQVKepdfEyHdQo4dhuZWHduhuVLsU0ZmdKJ69u-WbUoJW9WWb6WtW4xpeFUU6uy_3G6QXx-LANbqs8MEbWof5jEUKfOU2TFNBJKEsVWCM1OjSvbcvLRJpEQBoS7dFziTrIh23-2wSNaL4yvea7CDW4Vm62K99Vj39cDwyEeCHerdcz8veggHd4EFphGbb1iFHVG5mB_2YV6LqVdD_pzFV95LInZb6KE3dM6XcXdAz40K1K63Kkdz8zPCjjaBqC8NGs7G7JP9RK-JpHnbExUEGwCANik8ugIvzE66tEHhLRHaD5-brdUtHv7OtAsG3Erh11GFI_n7Y-_LuZdwdGtsrcM4vz_9-xGdrmGO8RVLWyOB9z3Z4BdDvNjyZ29ivBd46Fg_4JezMF4Elw?testcase_id=6120160663699456 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Feb 15 2017
ClusterFuzz testcase 6120160663699456 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by tkent@chromium.org
, Feb 3 2017