New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 758510 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Aug 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 1
Type: Bug
Team-Accessibility



Sign in to add a comment

Null-dereference READ in blink::ConnectToPermissionService

Project Member Reported by ClusterFuzz, Aug 24 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5848829416177664

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::ConnectToPermissionService
  blink::AXObjectCacheImpl::AddPermissionStatusListener
  blink::AXObjectCacheImpl::AXObjectCacheImpl
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=496793:496838

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5848829416177664

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: msrchandra@chromium.org
Components: UI>Accessibility
Labels: Test-Predator-Wrong-CLs M-62
Owner: dmazz...@chromium.org
Status: Assigned (was: Untriaged)
Predator could not provide any possible suspects.
Assigning to concern owner from CL --
https://chromium.googlesource.com/chromium/src/+log/be46659f3909c9c483330cbbe91e56cbfc428796..42810e97655ae281891d436544891bebd4cf9f34?pretty=fuller&n=10000

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/72947e01e2f423f13183457047bb7c8d763e1893

@dmazzoni -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Project Member

Comment 2 by ClusterFuzz, Aug 24 2017

Labels: OS-Windows OS-Mac
Project Member

Comment 3 by ClusterFuzz, Aug 29 2017

ClusterFuzz has detected this issue as fixed in range 497981:498026.

Detailed report: https://clusterfuzz.com/testcase?key=5848829416177664

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::ConnectToPermissionService
  blink::AXObjectCacheImpl::AddPermissionStatusListener
  blink::AXObjectCacheImpl::AXObjectCacheImpl
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=496793:496838
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=497981:498026

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5848829416177664

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Aug 29 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5848829416177664 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Cc: sandeepkumars@chromium.org dmazz...@chromium.org
 Issue 760055  has been merged into this issue.
Project Member

Comment 6 by bugdroid1@chromium.org, Aug 30 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5

commit 7b82a6d8665fe1b9cb1b1d096413ae532fa62da5
Author: Dominic Mazzoni <dmazzoni@chromium.org>
Date: Wed Aug 30 04:52:26 2017

Re-land: Add new permission dialog for accessibility events.

This is required as part of the Accessibility Object Model
phase 2 spec.

Originally landed: r496801
Reverted: r498006 due to:
* crbug.com/759379 - fixed by r498167
*  crbug.com/758510  - fixed by patch set 2
    (null check in AXObjectCacheImpl.cpp)

Bug:  746524 ,759379, 758510 
Change-Id: I6acf62366da7e6700dfa43e3c9cf10b4c6a966de
Tbr: haraken,mlamouri
Reviewed-on: https://chromium-review.googlesource.com/641983
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#498367}
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/android_webview/browser/aw_permission_manager.cc
[add] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/android/java/res/drawable-hdpi/infobar_accessibility_events.png
[add] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/android/java/res/drawable-mdpi/infobar_accessibility_events.png
[add] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/android/java/res/drawable-xhdpi/infobar_accessibility_events.png
[add] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/android/java/res/drawable-xxhdpi/infobar_accessibility_events.png
[add] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/android/java/res/drawable-xxxhdpi/infobar_accessibility_events.png
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/app/generated_resources.grd
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/browser/BUILD.gn
[add] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/browser/accessibility/accessibility_permission_context.cc
[add] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/browser/accessibility/accessibility_permission_context.h
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/browser/android/resource_id.h
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/browser/permissions/permission_manager.cc
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/browser/permissions/permission_request.h
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/browser/permissions/permission_request_impl.cc
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/chrome/browser/permissions/permission_util.cc
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/components/content_settings/core/browser/content_settings_registry.cc
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/components/content_settings/core/common/content_settings.cc
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/components/content_settings/core/common/content_settings_types.h
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/components/vector_icons/BUILD.gn
[add] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/components/vector_icons/accessibility.icon
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/content/browser/permissions/permission_service_impl.cc
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/content/public/browser/permission_type.h
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/content/shell/browser/layout_test/layout_test_message_filter.cc
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/LayoutTests/accessibility/aom-actions.html
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/LayoutTests/http/tests/resources/permissions-helper.js
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/Source/core/dom/AXObjectCache.cpp
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/Source/core/dom/AXObjectCache.h
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/Source/core/dom/AXObjectCacheBase.cpp
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/Source/core/dom/AXObjectCacheBase.h
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/Source/modules/accessibility/AXObject.cpp
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.h
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/Source/modules/accessibility/DEPS
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/Source/modules/permissions/PermissionDescriptor.idl
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/Source/modules/permissions/Permissions.cpp
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/public/platform/WebFeaturePolicyFeature.h
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/third_party/WebKit/public/platform/modules/permissions/permission.mojom
[modify] https://crrev.com/7b82a6d8665fe1b9cb1b1d096413ae532fa62da5/tools/metrics/histograms/enums.xml

Sign in to add a comment