New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 764147 link

Starred by 1 user
Status: WontFix
Owner:
keishi@chromium.org
Closed: Oct 2017
Cc:
█ mgiuca@chromium.org
kkaluri@chromium.org
keishi@chromium.org
█ msrchandra@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::ThreadState::ScheduleIdleGC

Project Member Reported by ClusterFuzz, Sep 12 2017 
Detailed report: https://clusterfuzz.com/testcase?key=4554093283770368

Fuzzer: afl_content_security_policy_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::ThreadState::ScheduleIdleGC
  blink::NormalPageArena::OutOfLineAllocate
  AllocateObject
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4554093283770368

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.

Comment 1 by kkaluri@chromium.org, Sep 12 2017

Cc: msrchandra@chromium.org keishi@chromium.org kkaluri@chromium.org
Components: Blink
Labels: Test-Predator-Wrong
Owner: mgiuca@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possibl suspects.
Using Code Search for the file, "HeapPage.cpp" assigning to the concern owner who might be related or worked on similar file.

Suspected CL: https://chromium.googlesource.com/chromium/src/+/16a22949c41721a9a8b80aa3a0c801dfb54b6bb8

mgiuca@ -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by mgiuca@chromium.org, Sep 12 2017

Cc: mgiuca@chromium.org
Owner: keishi@chromium.org
This CL is a revert of another CL (while sheriffing). Re-assigning to keishi@chromium.org (the creator of that CL) to investigate or re-land (if this CL fixes a null dereference).

Comment 3 by dtapu...@chromium.org, Sep 12 2017

Components: -Blink Blink>JavaScript
Project Member

Comment 4 by ClusterFuzz, Oct 1 2017

Components: Blink>MemoryAllocator>GarbageCollection
Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 5 by ClusterFuzz, Oct 17 2017

Status: WontFix (was: Assigned)
ClusterFuzz testcase 4554093283770368 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Comment 6 by mbarbe...@chromium.org, Nov 7 2017

Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
►

Sign in to add a comment