Stack-overflow in blink::SelectorChecker::MatchSelector |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5386521040650240 Fuzzer: inferno_layout_test_unmodified Job Type: mac_asan_content_shell Platform Id: mac Crash Type: Stack-overflow Crash Address: 0x7fff4fb0aee8 Crash State: blink::SelectorChecker::MatchSelector Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=338204:338244 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5386521040650240 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
May 29 2017
The test case intentionally overflows the stack by chaining 32k attribute selectors:
var simpleCases = [
["[type=foobar i]",[]]];
for (var testCase of simpleCases) {
var repeatedSelector = testCase[0];
for (var i = 0; i < 32617; ++i) {
repeatedSelector += testCase[0];
}
testSelectorVariants(repeatedSelector, testCase[1]);
}
There's lots of ways to do that in the engine, this isn't a bug.
,
May 31 2017
,
Jul 14 2017
ClusterFuzz testcase 5386521040650240 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace. |
||||
►
Sign in to add a comment |
||||
Comment 1 by msrchandra@chromium.org
, May 29 2017Labels: M-60 Test-Predator-Wrong
Owner: esprehn@chromium.org
Status: Assigned (was: Untriaged)