Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5168550932381696 Fuzzer: inferno_twister Job Type: mac_asan_content_shell Platform Id: mac Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: blink::ExecutionContext::completeURL blink::Worklet::import blink::V8Worklet::importMethodCallback Sanitizer: address (ASAN) Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_content_shell&range=446721:447186 Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97VeNkIB4xELTH7tCV48YRC2yJWVVyFL9uxrn2t6bmLMKzAe1_3bT6tyP12Zq-L5XaynGa6IxWY3kYVf2TIwFMQKSfFfwfPXbr734H-KOXfBPHVSbZBUlxsoHoug0ILeYDCkSBB_8GDQgc_Y_bTqqly_o9gM6YOG9kd1gAy0OWHPg6c5yQ2GXgpvq9Rb1G_e0Lkw3j-1C_iYMniXhjbSfZ3tGS82QIJBQeC9w39xP55_qd2WajsDjMW_JuV_bb06vYtc--hd-hQDp7NFqosBmG1k6E9BrKO6PMRqMQIG-oRCD1tkTPW78CereIIISCfhPGPz3q259i2OsE4ZeCrcveFtMvb1hOWrIG41Ie6uMufwMOfYGw?testcase_id=5168550932381696 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Could not find exact culprit CL using regression range and code search. Adding few devs for further triaging. could someone please look into the issue. Thank you
Using Code Search for the file, "Worklet.cpp", assigning to the concern owner. Suspecting Commit# https://chromium.googlesource.com/chromium/src/+/f1e393e2cab401597d52fe9b7ed90946c5d426d3 nhiroki -- Could you please look into the issue, kindly re-assign if this is not related to your changes. Thank You.
I can reproduce this and have a WIP fix.
A CL is under review: https://codereview.chromium.org/2697243003/
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/5989961e2951701ff4a2d74bde290a0d26b45370 commit 5989961e2951701ff4a2d74bde290a0d26b45370 Author: nhiroki <nhiroki@chromium.org> Date: Thu Feb 16 15:30:55 2017 Worklet: Avoid import() on a detached frame Without this fix, import() on a detached frame eventually crashes because of a null execution context. BUG= 689265 Review-Url: https://codereview.chromium.org/2697243003 Cr-Commit-Position: refs/heads/master@{#450972} [add] https://crrev.com/5989961e2951701ff4a2d74bde290a0d26b45370/third_party/WebKit/LayoutTests/http/tests/worklet/chromium/README.txt [add] https://crrev.com/5989961e2951701ff4a2d74bde290a0d26b45370/third_party/WebKit/LayoutTests/http/tests/worklet/chromium/import-on-detached-iframe.html [add] https://crrev.com/5989961e2951701ff4a2d74bde290a0d26b45370/third_party/WebKit/LayoutTests/http/tests/worklet/chromium/resources/blank.html [add] https://crrev.com/5989961e2951701ff4a2d74bde290a0d26b45370/third_party/WebKit/LayoutTests/http/tests/worklet/chromium/resources/empty-worklet-script.js [modify] https://crrev.com/5989961e2951701ff4a2d74bde290a0d26b45370/third_party/WebKit/Source/core/workers/Worklet.cpp
ClusterFuzz has detected this issue as fixed in range 450943:450980. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5168550932381696 Fuzzer: inferno_twister Job Type: mac_asan_content_shell Platform Id: mac Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: blink::ExecutionContext::completeURL blink::Worklet::import blink::V8Worklet::importMethodCallback Sanitizer: address (ASAN) Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_content_shell&range=446721:447186 Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_content_shell&range=450943:450980 Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97VeNkIB4xELTH7tCV48YRC2yJWVVyFL9uxrn2t6bmLMKzAe1_3bT6tyP12Zq-L5XaynGa6IxWY3kYVf2TIwFMQKSfFfwfPXbr734H-KOXfBPHVSbZBUlxsoHoug0ILeYDCkSBB_8GDQgc_Y_bTqqly_o9gM6YOG9kd1gAy0OWHPg6c5yQ2GXgpvq9Rb1G_e0Lkw3j-1C_iYMniXhjbSfZ3tGS82QIJBQeC9w39xP55_qd2WajsDjMW_JuV_bb06vYtc--hd-hQDp7NFqosBmG1k6E9BrKO6PMRqMQIG-oRCD1tkTPW78CereIIISCfhPGPz3q259i2OsE4ZeCrcveFtMvb1hOWrIG41Ie6uMufwMOfYGw?testcase_id=5168550932381696 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
It looks like my patch is working well. I'll close this.
Comment 1 by mummare...@chromium.org
, Feb 7 2017Labels: Test-Predator-Wrong M-58