Null-dereference in DesktopMediaPickerDialogView::Accept |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6362618519617536 Fuzzer: phoglund_webrtc_peerconnection Job Type: linux_ubsan_vptr_chrome Platform Id: linux Crash Type: Null-dereference Crash Address: 0x000000000000 Crash State: DesktopMediaPickerDialogView::Accept views::DialogClientView::AcceptWindow base::debug::TaskAnnotator::RunTask Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=464547:464551 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6362618519617536 Additional requirements: Requires HTTP Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jun 27 2017
Where can I find the "basic_screenshare extension"? Without it I can't run the test case locally.
,
Jun 27 2017
Maybe it's due to the test script, "window.postMessage({desktopSourceTypes: ['window', 'screen']}, '*');".
Here is a wild guess without knowing the details of the testcase:
Before my cl, the window picker of desktop capture has a fixed order of "screen"->"window"->"tab". And the test will blindly choose the default screen in the first screen tab of the picker.
After my cl, the order of tab in picker is defined by the desktopSourceTypes array from testcase, here it's "window"->"screen". I guess there is no default selected item in window tab(or even no windows at all on bots) so testcase will get null source id.
msrchandra@, could you please try to change the order in desktopSourceTypes to "screen"->"window" in the testcase to verify it, as phoglund@ is on leave?
,
Jun 27 2017
,
Jun 28 2017
ClusterFuzz has detected this issue as fixed in range 482763:482861. Detailed report: https://clusterfuzz.com/testcase?key=6362618519617536 Fuzzer: phoglund_webrtc_peerconnection Job Type: linux_ubsan_vptr_chrome Platform Id: linux Crash Type: Null-dereference Crash Address: 0x000000000000 Crash State: DesktopMediaPickerDialogView::Accept views::DialogClientView::AcceptWindow base::debug::TaskAnnotator::RunTask Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=464547:464551 Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=482763:482861 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6362618519617536 Additional requirements: Requires HTTP See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jun 28 2017
ClusterFuzz testcase 6362618519617536 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by msrchandra@chromium.org
, Jun 27 2017Labels: Test-Predator-Wrong M-59
Owner: braveyao@chromium.org
Status: Assigned (was: Untriaged)