Null-dereference READ in content::DeviceMotionEventPump::SendFakeDataForTesting |
||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5529115162836992 Fuzzer: inferno_layout_test_unmodified Job Type: mac_asan_content_shell Platform Id: mac Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: content::DeviceMotionEventPump::SendFakeDataForTesting base::debug::TaskAnnotator::RunTask blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=338204:338244 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5529115162836992 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Aug 30 2017
Predator and CL could not provide any possible suspects. Using Code Search for the file, "motion_event_pump.cc" assigning to the concern owner who might be related. Suspecting Commit# https://chromium.googlesource.com/chromium/src/+/4cd3f707add7024916ab41cf0b681f7f7d0d8c1f @juncai -- Could you please look into the issue, kindly re-assign if this is not related to your changes. Thank You.
,
Aug 30 2017
,
Aug 30 2017
This issue existed long before my CL was landed since this issue was filed on May 30, 2017 and my CL was landed on August 25, 2017. So I changed this issue to be available.
,
Sep 20 2017
Predator and CL could not provide any possible suspects. Using the code search for the file, “task_annotator.cc” assigning to concern owner from GIT revision log. Suspecting Commit# https://chromium.googlesource.com/chromium/src/+/60358094ba966ef30f1bcc446aa2c4afbdc1b4ac @tzik -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes. Thank You.
,
Sep 22 2017
,
Sep 22 2017
Unable to provide possible suspect using Predator, CL and Code Search. Could someone please look into the issue. Thank You.
,
Oct 1 2017
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
,
Oct 2 2017
https://chromium-review.googlesource.com/#/c/chromium/src/+/695873 should resolve this issue.
,
Oct 6 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/9f68ff4d6110c632f087c3ba0fb66abe1b9f1fc3 commit 9f68ff4d6110c632f087c3ba0fb66abe1b9f1fc3 Author: Reilly Grant <reillyg@chromium.org> Date: Fri Oct 06 21:19:29 2017 Prevent crash when sending fake sensor data If there is no currently registered event listener then there is nothing to notify when a fake sensor event is reported. This resolves a crash discovered by ClusterFuzz when mangling existing LayoutTests. This issue is not reproducible by normal web content. Bug: 727936 , 757831 Change-Id: I4ea874b9e738f94a4a2e5b2b20cd2f3124242ddc Reviewed-on: https://chromium-review.googlesource.com/695873 Reviewed-by: Tim Volodine <timvolodine@chromium.org> Commit-Queue: Reilly Grant <reillyg@chromium.org> Cr-Commit-Position: refs/heads/master@{#507180} [modify] https://crrev.com/9f68ff4d6110c632f087c3ba0fb66abe1b9f1fc3/content/renderer/device_sensors/device_motion_event_pump.cc [modify] https://crrev.com/9f68ff4d6110c632f087c3ba0fb66abe1b9f1fc3/content/renderer/device_sensors/device_orientation_event_pump.cc
,
Oct 6 2017
,
Oct 7 2017
ClusterFuzz has detected this issue as fixed in range 507174:507213. Detailed report: https://clusterfuzz.com/testcase?key=5529115162836992 Fuzzer: inferno_layout_test_unmodified Job Type: mac_asan_content_shell Platform Id: mac Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: content::DeviceMotionEventPump::SendFakeDataForTesting base::debug::TaskAnnotator::RunTask blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=338204:338244 Fixed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=507174:507213 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5529115162836992 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Oct 7 2017
ClusterFuzz testcase 5529115162836992 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Nov 7 2017
|
||||||||||||
►
Sign in to add a comment |
||||||||||||
Comment 1 by ClusterFuzz
, May 31 2017