Stack-overflow in blink::ContainerNode::AttachLayoutTree |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4619535704653824 Fuzzer: inferno_layout_test_unmodified Job Type: mac_asan_chrome Platform Id: mac Crash Type: Stack-overflow Crash Address: 0x7fff4fd63fe8 Crash State: blink::ContainerNode::AttachLayoutTree blink::Element::AttachLayoutTree Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=458620:458734 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4619535704653824 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Sep 5 2017
Predator and CL could not provide any possible suspects. Using Code Search for the file, "ContainerNode.cpp" assigning to the concern owner who might be related. Suspecting Commit# https://chromium.googlesource.com/chromium/src/+/3c20bd90901729410d0f83631943f188a35068f3 @mlippautz -- Could you please look into the issue, kindly re-assign if this is not related to your changes. Thank You.
,
Sep 19 2017
Assigning based on file names is almost certainly not going to yield any good candidates for owners. The CL in question is completely unrelated.
,
Sep 19 2017
Thank you for the update. Assigning to the concern owner from CL -- https://chromium.googlesource.com/chromium/src/+log/a737f9c91cf432640a454d51ffca2d398ef00c00..531f367559cc5168afc8ef2ce1219ecbcc9de2a8?pretty=fuller&n=10000 Suspecting Commit# https://chromium.googlesource.com/chromium/src/+/d6f8a937c0d8fbfcbdfe7edc93255e454c5de3cf @rune -- Could you please look into the issue, kindly re-assign if this is not related to your changes. Thank You.
,
Sep 19 2017
Nothing in my change which should increase stack usage. Stack overflow attaching a very deep dom tree.
,
Sep 26 2017
ClusterFuzz testcase 4619535704653824 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
,
Sep 26 2017
,
Sep 27 2017
ClusterFuzz has detected this issue as fixed in range 504363:504398. Detailed report: https://clusterfuzz.com/testcase?key=4619535704653824 Fuzzer: inferno_layout_test_unmodified Job Type: mac_asan_chrome Platform Id: mac Crash Type: Stack-overflow Crash Address: 0x7fff5147bfa0 Crash State: blink::Element::AttachLayoutTree blink::SVGElement::AttachLayoutTree blink::ContainerNode::AttachLayoutTree Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=458620:458734 Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=504363:504398 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4619535704653824 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by ClusterFuzz
, Sep 5 2017