New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 765719 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::StyleBuilderConverterBase::ConvertFontSize

Project Member Reported by ClusterFuzz, Sep 15 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6151548723003392

Fuzzer: mbarbella_js_mutation_layout
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x00000000
Crash State:
  blink::StyleBuilderConverterBase::ConvertFontSize
  blink::FontStyleResolver::ComputeFont
  blink::OffscreenCanvasRenderingContext2D::setFont
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=491007:491035

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6151548723003392

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Status: sd (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "StyleBuilderConverter.cpp" assigning to concern owner using GIT Blame.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/4d8733fe8c6e16b9bd8605bb15b0003df39d11e4

@fserb -- Could you please look into the issue, kindly re-assign if this has nothing to do with your changes.
Thank You.
Cc: msrchandra@chromium.org gyuyoung...@chromium.org
Components: Blink>CSS
Labels: Test-Predator-Wrong-CLs M-63
Owner: fs...@chromium.org
Status: Assigned (was: sd)
Project Member

Comment 3 by ClusterFuzz, Sep 16 2017

Labels: OS-Linux

Comment 4 by fs...@chromium.org, Sep 19 2017

Status: Started (was: Assigned)
Fixed. on review.
Labels: Update-Weekly
Project Member

Comment 6 by bugdroid1@chromium.org, Sep 27 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bc66507fe84e55673529822f21ee15c041430791

commit bc66507fe84e55673529822f21ee15c041430791
Author: Fernando Serboncini <fserb@chromium.org>
Date: Wed Sep 27 20:56:41 2017

Check for CSS properties before using them on FontStyleResolver

Bug:  765719 
Change-Id: Id172d596202bab6c2e8093b285feacceadc4425a
Reviewed-on: https://chromium-review.googlesource.com/672665
Commit-Queue: Fernando Serboncini <fserb@chromium.org>
Reviewed-by: Dominik Röttsches <drott@chromium.org>
Reviewed-by: Eric Willigers <ericwilligers@chromium.org>
Cr-Commit-Position: refs/heads/master@{#504766}
[modify] https://crrev.com/bc66507fe84e55673529822f21ee15c041430791/third_party/WebKit/Source/core/BUILD.gn
[modify] https://crrev.com/bc66507fe84e55673529822f21ee15c041430791/third_party/WebKit/Source/core/css/resolver/FontStyleResolver.cpp
[add] https://crrev.com/bc66507fe84e55673529822f21ee15c041430791/third_party/WebKit/Source/core/css/resolver/FontStyleResolverTest.cpp

Project Member

Comment 7 by ClusterFuzz, Sep 28 2017

ClusterFuzz has detected this issue as fixed in range 504724:504793.

Detailed report: https://clusterfuzz.com/testcase?key=6151548723003392

Fuzzer: mbarbella_js_mutation_layout
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x00000000
Crash State:
  blink::StyleBuilderConverterBase::ConvertFontSize
  blink::FontStyleResolver::ComputeFont
  blink::OffscreenCanvasRenderingContext2D::setFont
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=491007:491035
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=504724:504793

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6151548723003392

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Sep 28 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 6151548723003392 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment