New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 758426 link

Starred by 1 user
Status: WontFix
Owner:
█ ka...@opera.com
Email to this user bounced
Closed: Oct 2017
Cc:
█ sandeepkumars@chromium.org
█ msrchandra@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::RootInlineBox::AscentAndDescentForBox

Project Member Reported by ClusterFuzz, Aug 24 2017 
Detailed report: https://clusterfuzz.com/testcase?key=5832897973190656

Fuzzer: dstockwell-css-fuzzer
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000034
Crash State:
  blink::RootInlineBox::AscentAndDescentForBox
  blink::InlineFlowBox::ComputeLogicalBoxHeights
  blink::RootInlineBox::AlignBoxesInBlockDirection
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5832897973190656

Additional requirements: Requires Gestures

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. If the fix resolved the issue, please close the bug by marking as Fixed.

Comment 1 by dtapu...@chromium.org, Aug 25 2017

Components: Blink>Layout

Comment 2 by sandeepkumars@chromium.org, Aug 28 2017

Cc: msrchandra@chromium.org sandeepkumars@chromium.org
Labels: M-62 Test-Predator-Correct-CLs
Owner: ka...@opera.com
Status: Assigned (was: Untriaged)
Assigning to concern owner form Predator results.

Author: Karl Anders Øygard
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/abc4634436dd4fc1b909ec04e589288464d432aa
Time: Fri Jul 28 08:53:18 2017
The CL last changed line 626 of file RootInlineBox.cpp, which is stack frame 1.

Comment 3 by sandeepkumars@chromium.org, Aug 28 2017 

@karlo -- Could you please look into the issue, kindly re-assign if this is not related to your changes.

Thank You.

Comment 4 by phimprak...@gmail.com, Sep 3 2017

chromium-issues.csv
223 KB View Download
Project Member

Comment 5 by ClusterFuzz, Oct 1 2017

Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 6 by ClusterFuzz, Oct 7 2017

Status: WontFix (was: Assigned)
ClusterFuzz testcase 5832897973190656 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Comment 7 by mbarbe...@chromium.org, Nov 7 2017

Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
►

Sign in to add a comment