Null-dereference READ in blink::StyleBuilderConverterBase::ConvertFontSize |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6151548723003392 Fuzzer: mbarbella_js_mutation_layout Job Type: windows_asan_content_shell Platform Id: windows Crash Type: Null-dereference READ Crash Address: 0x00000000 Crash State: blink::StyleBuilderConverterBase::ConvertFontSize blink::FontStyleResolver::ComputeFont blink::OffscreenCanvasRenderingContext2D::setFont Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=491007:491035 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6151548723003392 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Sep 15 2017
,
Sep 16 2017
,
Sep 19 2017
Fixed. on review.
,
Sep 21 2017
,
Sep 27 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/bc66507fe84e55673529822f21ee15c041430791 commit bc66507fe84e55673529822f21ee15c041430791 Author: Fernando Serboncini <fserb@chromium.org> Date: Wed Sep 27 20:56:41 2017 Check for CSS properties before using them on FontStyleResolver Bug: 765719 Change-Id: Id172d596202bab6c2e8093b285feacceadc4425a Reviewed-on: https://chromium-review.googlesource.com/672665 Commit-Queue: Fernando Serboncini <fserb@chromium.org> Reviewed-by: Dominik Röttsches <drott@chromium.org> Reviewed-by: Eric Willigers <ericwilligers@chromium.org> Cr-Commit-Position: refs/heads/master@{#504766} [modify] https://crrev.com/bc66507fe84e55673529822f21ee15c041430791/third_party/WebKit/Source/core/BUILD.gn [modify] https://crrev.com/bc66507fe84e55673529822f21ee15c041430791/third_party/WebKit/Source/core/css/resolver/FontStyleResolver.cpp [add] https://crrev.com/bc66507fe84e55673529822f21ee15c041430791/third_party/WebKit/Source/core/css/resolver/FontStyleResolverTest.cpp
,
Sep 28 2017
ClusterFuzz has detected this issue as fixed in range 504724:504793. Detailed report: https://clusterfuzz.com/testcase?key=6151548723003392 Fuzzer: mbarbella_js_mutation_layout Job Type: windows_asan_content_shell Platform Id: windows Crash Type: Null-dereference READ Crash Address: 0x00000000 Crash State: blink::StyleBuilderConverterBase::ConvertFontSize blink::FontStyleResolver::ComputeFont blink::OffscreenCanvasRenderingContext2D::setFont Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=491007:491035 Fixed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=504724:504793 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6151548723003392 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 28 2017
ClusterFuzz testcase 6151548723003392 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by msrchandra@chromium.org
, Sep 15 2017