Crash in blink::ReportFatalErrorInMainThread |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4751023664267264 Fuzzer: inferno_canvas_wrecker Job Type: windows_asan_chrome Platform Id: windows Crash Type: UNKNOWN READ Crash Address: 0x00000000 Crash State: blink::ReportFatalErrorInMainThread v8::Uint8ClampedArray::New blink::DOMTypedArray<WTF::Uint8ClampedArray,v8::Uint8ClampedArray>::Wrap Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=464127:464504 Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96__Rk6OtnCjxmZTWtWdrOvJk4T859vELQJ6pzEhb0p4JmV5H2M2aesEDLfmGsRNH_xjGpMUvG-CM_OyVSOHRgr1Fo2Fv9xjmFFbM2UJDWIXbLhaa3CE38PpmpHtFLn3IrX7v2DAnoNnWIURj6zjzqEDdYgyxWieqRjQ_PMVZ8VRfB3mp9j3Q2tuT8GDZQTnOY-Kt-SWzjqDgfVLp1jqfnUpCP3CKM6WBx8cc-fhjotEUPe2WrvgH8WFTOI-odFeaDqChZemqQ8bsFPrc1tlHGBL4OF6cI4nFDC6NjbLwgOp_6JLtk2pD79N417-nBbtFbjlNLLg3PcUrpa2T040QP5-arcIjYJ6Znva3-TadEX8WFSk68?testcase_id=4751023664267264 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Apr 18 2017
jochen@ / cbruni@ / dslomov@ - could you PTAL? (based on git blame around TYPED_ARRAY_NEW macro definition in v8/src/api.cc)
,
Apr 18 2017
The test case tries to create a canvas with more than 2^31 bytes. |
|||
►
Sign in to add a comment |
|||
Comment 1 by msrchandra@chromium.org
, Apr 18 2017Components: Blink>Bindings
Labels: Test-Predator-Wrong-CLs M-60
Owner: lukasza@chromium.org
Status: Assigned (was: Untriaged)