Issue metadata
Sign in to add a comment
|
Security: Crash in ChromeDevToolsManagerDelegate::GetTargetTitle
Reported by
chromium...@gmail.com,
Apr 3 2017
|
||||||||||||||||||||||
Issue descriptionChrome Version: 59.0.3060.0 Canary Operating System: Windows 7 REPRODUCTION CASE Actually this crash happened three times with opening the Devtools. Type of crash: browser 0:000> .ecxr rax=00007f4eeea7451f rbx=000000000032a730 rcx=8d8c8c8c0a0a0a0a rdx=000000000032a730 rsi=00000000126336e8 rdi=0000000012413d60 rip=000007fee997380d rsp=000000000032a6a0 rbp=000000000032a6f0 r8=0000000012413d60 r9=0000000000000000 r10=0000000014449fb0 r11=00000000144498b0 r12=00000000126336c8 r13=00000000126336c0 r14=0000000000000000 r15=000000000032a960 iopl=0 nv up ei pl nz na po nc cs=0033 ss=0000 ds=0000 es=0000 fs=0053 gs=002b efl=00010206 *** WARNING: Unable to verify checksum for chrome.dll chrome_7fee80d0000!ChromeDevToolsManagerDelegate::GetTargetTitle+0x3d: 000007fe`e997380d 488b01 mov rax,qword ptr [rcx] ds:8d8c8c8c`0a0a0a0a=???????????????? 0:000> k *** Stack trace for last set context - .thread/.cxr resets it Child-SP RetAddr Call Site 00000000`0032a6a0 000007fe`e84efc90 chrome_7fee80d0000!ChromeDevToolsManagerDelegate::GetTargetTitle+0x3d [c:\b\build\slave\win64-pgo\build\src\chrome\browser\devtools\chrome_devtools_manager_delegate.cc @ 134] 00000000`0032a710 000007fe`e84e4877 chrome_7fee80d0000!content::RenderFrameDevToolsAgentHost::GetTitle+0x50 [c:\b\build\slave\win64-pgo\build\src\content\browser\devtools\render_frame_devtools_agent_host.cc @ 1021] 00000000`0032a7f0 000007fe`e84e705f chrome_7fee80d0000!content::protocol::`anonymous namespace'::CreateInfo+0xbf [c:\b\build\slave\win64-pgo\build\src\content\browser\devtools\protocol\target_handler.cc @ 86] 00000000`0032a940 000007fe`e84c48b9 chrome_7fee80d0000!content::protocol::TargetHandler::DevToolsAgentHostCreated+0xbf [c:\b\build\slave\win64-pgo\build\src\content\browser\devtools\protocol\target_handler.cc @ 417] 00000000`0032a9d0 000007fe`e84e5b6e chrome_7fee80d0000!content::DevToolsAgentHost::AddObserver+0x145 [c:\b\build\slave\win64-pgo\build\src\content\browser\devtools\devtools_agent_host_impl.cc @ 295] 00000000`0032aa20 000007fe`e83f8890 chrome_7fee80d0000!content::protocol::TargetHandler::SetDiscoverTargets+0x5e [c:\b\build\slave\win64-pgo\build\src\content\browser\devtools\protocol\target_handler.cc @ 247] 00000000`0032aa90 000007fe`e83d4f90 chrome_7fee80d0000!content::protocol::Target::DispatcherImpl::setDiscoverTargets+0x220 [c:\b\build\slave\win64-pgo\build\src\out\release_x64\gen\content\browser\devtools\protocol\target.cc @ 419] 00000000`0032aba0 000007fe`e83ed435 chrome_7fee80d0000!content::protocol::DOM::DispatcherImpl::dispatch+0x160 [c:\b\build\slave\win64-pgo\build\src\out\release_x64\gen\content\browser\devtools\protocol\dom.cc @ 120] 00000000`0032ac80 000007fe`e84ce207 chrome_7fee80d0000!content::protocol::UberDispatcher::dispatch+0x581 [c:\b\build\slave\win64-pgo\build\src\out\release_x64\gen\content\browser\devtools\protocol\protocol.cc @ 837] 00000000`0032ada0 000007fe`e84ee9f4 chrome_7fee80d0000!content::DevToolsSession::Dispatch+0x18f [c:\b\build\slave\win64-pgo\build\src\content\browser\devtools\devtools_session.cc @ 81] 00000000`0032ae50 000007fe`e9989acd chrome_7fee80d0000!content::RenderFrameDevToolsAgentHost::DispatchProtocolMessage+0x54 [c:\b\build\slave\win64-pgo\build\src\content\browser\devtools\render_frame_devtools_agent_host.cc @ 558] 00000000`0032af50 000007fe`e9990de0 chrome_7fee80d0000!DevToolsUIBindings::DispatchProtocolMessageFromDevToolsFrontend+0x1d [c:\b\build\slave\win64-pgo\build\src\chrome\browser\devtools\devtools_ui_bindings.cc @ 1049] 00000000`0032af80 000007fe`e998f553 chrome_7fee80d0000!`anonymous namespace'::ParseAndHandle<std::basic_string<char,std::char_traits<char>,std::allocator<char> > const & __ptr64>+0x70 [c:\b\build\slave\win64-pgo\build\src\chrome\browser\devtools\devtools_embedder_message_dispatcher.cc @ 91] 00000000`0032afe0 000007fe`e9986ff4 chrome_7fee80d0000!DispatcherImpl::Dispatch+0x83 [c:\b\build\slave\win64-pgo\build\src\chrome\browser\devtools\devtools_embedder_message_dispatcher.cc @ 124] 00000000`0032b030 000007fe`e87b64bc chrome_7fee80d0000!DevToolsUIBindings::HandleMessageFromDevToolsFrontend+0x254 [c:\b\build\slave\win64-pgo\build\src\chrome\browser\devtools\devtools_ui_bindings.cc @ 609] 00000000`0032b2d0 000007fe`e87b6307 chrome_7fee80d0000!IPC::MessageT<DevToolsHostMsg_DispatchOnEmbedder_Meta,std::tuple<std::basic_string<char,std::char_traits<char>,std::allocator<char> > >,void>::Dispatch<content::DevToolsFrontendHostImpl,content::DevToolsFrontendHostImpl,void,void (__cdecl content::DevToolsFrontendHostImpl::*)(std::basic_string<char,std::char_traits<char>,std::allocator<char> > const & __ptr64) __ptr64>+0x154 [c:\b\build\slave\win64-pgo\build\src\ipc\ipc_message_templates.h @ 121] 00000000`0032b3f0 000007fe`e8758860 chrome_7fee80d0000!content::DevToolsFrontendHostImpl::OnMessageReceived+0xe7 [c:\b\build\slave\win64-pgo\build\src\content\browser\devtools\devtools_frontend_host_impl.cc @ 74] 00000000`0032b4f0 000007fe`e85590a8 chrome_7fee80d0000!content::WebContentsImpl::OnMessageReceived+0x80 [c:\b\build\slave\win64-pgo\build\src\content\browser\web_contents\web_contents_impl.cc @ 738] 00000000`0032c540 000007fe`e869370a chrome_7fee80d0000!content::RenderFrameHostImpl::OnMessageReceived+0x118 [c:\b\build\slave\win64-pgo\build\src\content\browser\frame_host\render_frame_host_impl.cc @ 726] 00000000`0032e770 000007fe`e8e936b8 chrome_7fee80d0000!content::RenderProcessHostImpl::OnMessageReceived+0x55a [c:\b\build\slave\win64-pgo\build\src\content\browser\renderer_host\render_process_host_impl.cc @ 2079]
,
Apr 3 2017
,
Apr 3 2017
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Apr 3 2017
@caseq: mind taking a look?
,
Apr 3 2017
Here is a Crash ID: crash/a102739c10000000.
,
Apr 4 2017
,
Jul 12 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by dominickn@chromium.org
, Apr 3 2017Labels: Security_Severity-High Security_Impact-Head OS-Windows Pri-1
Owner: dgozman@chromium.org
Status: Assigned (was: Unconfirmed)