New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 761282 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference in WTF::StringHash::GetHash

Project Member Reported by ClusterFuzz, Sep 1 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5859765006893056

Fuzzer: inferno_twister
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: Null-dereference
Crash Address: 0x0000000b
Crash State:
  WTF::StringHash::GetHash
  blink::NetworkInformation::GetRandomMultiplier
  blink::NetworkInformation::RoundRtt
  
Memory Tool: SYZYASAN

Regressed: https://clusterfuzz.com/revisions?job=windows_syzyasan_chrome&range=494860:494916

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5859765006893056

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Labels: M-62 Test-Predator-Wrong CF-NeedsTriage
Project Member

Comment 2 by ClusterFuzz, Sep 8 2017

Labels: ReleaseBlock-Stable ClusterFuzz-Top-Crash
Testcase 5859765006893056 is a top crash on ClusterFuzz for windows platform. Please prioritize fixing this crash.

Marking this crash as a stable release blocker. If this is incorrect, remove the ReleaseBlock label.
Cc: msrchandra@chromium.org
Owner: tbansal@chromium.org
Status: Assigned (was: Untriaged)
Predator could not provide any possible suspects.
Assigning to concern owner from CL --
https://chromium.googlesource.com/chromium/src/+log/64851d6549e974416f48bf85a95621076393ae16..54ddcd7428d3118aca85cd4277b610c40667e56b?pretty=fuller&n=10000

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/f609e92a2ac7f44160901945b55337fcbf5e17a5

@tbansal -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Cc: tbansal@chromium.org
 Issue 761521  has been merged into this issue.
Status: Started (was: Assigned)
Cc: -tbansal@chromium.org
Components: Internals>Network>NetworkQuality
Labels: OS-Linux
Project Member

Comment 8 by bugdroid1@chromium.org, Sep 12 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/038025ec209c90d663b58f3c45a18cfb28cd684d

commit 038025ec209c90d663b58f3c45a18cfb28cd684d
Author: Tarun Bansal <tbansal@chromium.org>
Date: Tue Sep 12 02:47:52 2017

Fix null crash in  NetInfo

Check if the host String is null before computing the hash of 
the String.

Bug:  761282 
Change-Id: I76302c544e101bfabba56d77ce0ea40581057176
Reviewed-on: https://chromium-review.googlesource.com/662018
Commit-Queue: Tarun Bansal <tbansal@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#501160}
[modify] https://crrev.com/038025ec209c90d663b58f3c45a18cfb28cd684d/third_party/WebKit/Source/modules/netinfo/NetworkInformation.cpp

Project Member

Comment 9 by ClusterFuzz, Sep 12 2017

Labels: OS-Android
Project Member

Comment 10 by ClusterFuzz, Sep 12 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 4519394767273984 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: Merge-TBD
[Auto-generated comment by a script] We noticed that this issue is targeted for M-62; it appears the fix may have landed after branch point, meaning a merge might be required. Please confirm if a merge is required here - if so add Merge-Request-62 label, otherwise remove Merge-TBD label. Thanks.
Labels: Merge-Request-62
Status: Started (was: Verified)
Requesting merge for CL in #8. This is a pretty straightforward fix. Clusterfuzz verified that the CL fixes the bug has been verified in https://bugs.chromium.org/p/chromium/issues/detail?id=761521#c5.
Labels: -Merge-TBD
Project Member

Comment 14 by ClusterFuzz, Sep 12 2017

ClusterFuzz has detected this issue as fixed in range 501139:501164.

Detailed report: https://clusterfuzz.com/testcase?key=5859765006893056

Fuzzer: inferno_twister
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: Null-dereference
Crash Address: 0x0000000b
Crash State:
  WTF::StringHash::GetHash
  blink::NetworkInformation::GetRandomMultiplier
  blink::NetworkInformation::RoundRtt
  
Memory Tool: SYZYASAN

Regressed: https://clusterfuzz.com/revisions?job=windows_syzyasan_chrome&range=494860:494916
Fixed: https://clusterfuzz.com/revisions?job=windows_syzyasan_chrome&range=501139:501164

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5859765006893056

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 15 by sheriffbot@chromium.org, Sep 13 2017

Labels: -Merge-Request-62 Hotlist-Merge-Approved Merge-Approved-62
Your change meets the bar and is auto-approved for M62. Please go ahead and merge the CL to branch 3202 manually. Please contact milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 16 by bugdroid1@chromium.org, Sep 13 2017

Labels: -merge-approved-62 merge-merged-3202
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5c61ddc7b151373556f99bcb32015d607d0b8705

commit 5c61ddc7b151373556f99bcb32015d607d0b8705
Author: Tarun Bansal <tbansal@chromium.org>
Date: Wed Sep 13 14:31:50 2017

Fix null crash in  NetInfo

Check if the host String is null before computing the hash of 
the String.

Bug:  761282 
Change-Id: I76302c544e101bfabba56d77ce0ea40581057176
Reviewed-on: https://chromium-review.googlesource.com/662018
Commit-Queue: Tarun Bansal <tbansal@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#501160}(cherry picked from commit 038025ec209c90d663b58f3c45a18cfb28cd684d)
Reviewed-on: https://chromium-review.googlesource.com/665217
Reviewed-by: Tarun Bansal <tbansal@chromium.org>
Cr-Commit-Position: refs/branch-heads/3202@{#198}
Cr-Branched-From: fa6a5d87adff761bc16afc5498c3f5944c1daa68-refs/heads/master@{#499098}
[modify] https://crrev.com/5c61ddc7b151373556f99bcb32015d607d0b8705/third_party/WebKit/Source/modules/netinfo/NetworkInformation.cpp

Status: Fixed (was: Started)
Issue 764878 has been merged into this issue.

Sign in to add a comment