Issue metadata
Sign in to add a comment
|
Stack-overflow in blink::LayoutSVGContainer::layout |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5088928354009088 Fuzzer: attekett_surku_fuzzer Job Type: mac_asan_chrome Platform Id: mac Crash Type: Stack-overflow Crash Address: 0x7fff5bdcdd98 Crash State: blink::LayoutSVGContainer::layout blink::LayoutSVGViewportContainer::layout blink::SVGLayoutSupport::layoutChildren Sanitizer: address (ASAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5088928354009088 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
May 1 2017
,
May 1 2017
Another stack overflow bug that we will not attempt to fix. It's a huge number of nested VSG elements. Better to crash than try to process content like this.
,
May 12 2017
ClusterFuzz has detected this issue as fixed in range 471041:471079. Detailed report: https://clusterfuzz.com/testcase?key=5088928354009088 Fuzzer: attekett_surku_fuzzer Job Type: mac_asan_chrome Platform Id: mac Crash Type: Stack-overflow Crash Address: 0x7fff5bdcdd98 Crash State: blink::LayoutSVGContainer::layout blink::LayoutSVGViewportContainer::layout blink::SVGLayoutSupport::layoutChildren Sanitizer: address (ASAN) Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=471041:471079 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5088928354009088 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
May 15 2017
This seems to have been an instance of crbug.com/718386 which was a real regression. I am not sure why the regression range was reported as the beginning of time though. |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by shrike@chromium.org
, Apr 28 2017