New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 688231 link

Starred by 1 user

Issue metadata

Status: Verified
Owner: ----
Closed: Feb 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows , Mac
Pri: 2
Type: Bug



Sign in to add a comment

content CSS property and -webkit-mask-image breaks insertOrderedList command

Project Member Reported by ClusterFuzz, Feb 3 2017

Issue description

Comment 1 by tkent@chromium.org, Feb 3 2017

Components: Blink>Editing
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong M-57
Owner: hayato@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL did not find any possible suspects.
Using Code Search for the file, "FlatTreeTraversal.cpp" assigning to the concern owner.

@hayato -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Cc: hayato@chromium.org
Owner: yosin@chromium.org
yosin@

Yet another FlatTreeTraversal bug is coming, involving Editing!
Could you take a look? If you need my help, please feel free to re-assign to me. 

Comment 4 by yosin@chromium.org, Feb 6 2017

Labels: OS-Windows
Hit DCHECK(m_selectionInFlatTree.isValidFor(document())) << m_selection;
in SelectionEditor::updateIfNeeded()

SelectionEditor::m_selection is null, but m_selectionInFlatTree is BeforeAnchor, SELECT (not connected)

BODY id="htmlvar00021"
	#text "\n"
	LI id="htmlvar00022" style="content: url(\"data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7\");"
		#text "\n"
		FORM id="htmlvar00042"
			#text "\n"
			TEXTAREA
				#shadow-root
					DIV id="inner-editor"
			#text "\n"
	#text "\n"
SE	SELECT id="htmlvar00089"
SE		#shadow-root
SE			CONTENT
		#text "\n"
start: beforeAnchor
end: beforeAnchor


blink::SelectionEditor::updateIfNeeded() Line 163
blink::FrameSelection::updateIfNeeded() Line 1396
blink::enabledInRichlyEditableText(blink::LocalFrame & frame, blink::Event * __formal, blink::EditorCommandSource __formal) Line 1903
blink::Editor::Command::isEnabled(blink::Event * triggeringEvent) Line 2683
blink::Editor::Command::execute(const WTF::String & parameter, blink::Event * triggeringEvent) Line 2633
blink::Document::execCommand(const WTF::String & commandName, bool __formal, const WTF::String & value, blink::ExceptionState & exceptionState) Line 91
blink::DocumentV8Internal::execCommandMethod(const v8::FunctionCallbackInfo<v8::Value> & info) Line 3194
blink::V8Document::execCommandMethodCallback(const v8::FunctionCallbackInfo<v8::Value> & info) Line 5338
v8.dll!v8::internal::FunctionCallbackArguments::Call(void(*)(const v8::FunctionCallbackInfo<v8::Value> &) f) Line 26
v8.dll!v8::internal::`anonymous namespace'::HandleApiCallHelper<0>(v8::internal::Isolate * isolate, v8::internal::Handle<v8::internal::HeapObject> function, v8::internal::Handle<v8::internal::HeapObject> new_target, v8::internal::Handle<v8::internal::FunctionTemplateInfo> fun_data, v8::internal::Handle<v8::internal::Object> receiver, v8::internal::BuiltinArguments args) Line 108
v8.dll!v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments args, v8::internal::Isolate * isolate) Line 135

Comment 5 by yosin@chromium.org, Feb 6 2017

Labels: -Pri-1 Pri-2
Owner: ----
Status: Available (was: Assigned)
Summary: content CSS property and -webkit-mask-image breaks insertOrderedList command (was: Crash in blink::FlatTreeTraversal::traverseParent)
Lower to Pri-2 since real world usage of insertOrderedListCommand with -webkit-mask-image is low.

The root cause is "insertOrderedList" commands set selectionInDOMTree to null and selectionInFlatTree to BeforeAnchor, SELECT.

This prevents to update selecitonInFlatTree at BODY node removal by |document.body.replaceWith()|

Here is minimized script:

<script>
window.onload = function() {
  document.querySelector('li').style.setProperty('content', 'url(data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7)'); 
  document.execCommand("insertOrderedList");
  document.body.replaceWith();
  document.execCommand("strikeThrough"); 
};
</script>
<body>
<li><form><textarea autofocus></textarea></form></li>
<select><option style="-webkit-mask-image: url(#foo);"></option></select>

Project Member

Comment 6 by ClusterFuzz, Feb 15 2017

ClusterFuzz has detected this issue as fixed in range 450347:450401.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6120160663699456

Fuzzer: ifratric-browserfuzzer-v3
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  blink::FlatTreeTraversal::traverseParent
  blink::PositionIteratorAlgorithm<blink::EditingAlgorithm<blink::FlatTreeTraversa
  blink::mostBackwardCaretPosition
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=408575:408586
Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=450347:450401

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97dwReBHCnx4cFQjQVKepdfEyHdQo4dhuZWHduhuVLsU0ZmdKJ69u-WbUoJW9WWb6WtW4xpeFUU6uy_3G6QXx-LANbqs8MEbWof5jEUKfOU2TFNBJKEsVWCM1OjSvbcvLRJpEQBoS7dFziTrIh23-2wSNaL4yvea7CDW4Vm62K99Vj39cDwyEeCHerdcz8veggHd4EFphGbb1iFHVG5mB_2YV6LqVdD_pzFV95LInZb6KE3dM6XcXdAz40K1K63Kkdz8zPCjjaBqC8NGs7G7JP9RK-JpHnbExUEGwCANik8ugIvzE66tEHhLRHaD5-brdUtHv7OtAsG3Erh11GFI_n7Y-_LuZdwdGtsrcM4vz_9-xGdrmGO8RVLWyOB9z3Z4BdDvNjyZ29ivBd46Fg_4JezMF4Elw?testcase_id=6120160663699456


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Feb 15 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 6120160663699456 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment