New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 765904 link

Starred by 1 user

Issue metadata

Status: Verified
Owner: ----
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

Extend selection with "sentence" granularity yields start > end range

Project Member Reported by ClusterFuzz, Sep 16 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4599428676845568

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  start <= end (OUTPUT id="htmlvarNUMBER" style="-webkit-background-origin: border
  blink::TextIteratorAlgorithm<>::TextIteratorAlgorithm
  blink::NextBoundary
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=475811:475824

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4599428676845568

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: msrchandra@chromium.org kkaluri@chromium.org
Components: Blink
Labels: M-61 Test-Predator-Wrong CF-NeedsTriage
Unable to find the possible suspect using Predator, CL and Code Search.Hence untriaging this issue, Could some one please look into the issue.

Thank You.
Components: -Blink Blink>Editing>Selection

Comment 3 by yosin@chromium.org, Sep 19 2017

Labels: -Pri-1 Pri-3
Status: Available (was: Untriaged)
Summary: Extend selection with "sentence" granularity yields start > end range (was: CHECK failure: start <= end (OUTPUT id="htmlvarNUMBER" style="-webkit-background-origin: border)
Lower to Pri-3 since real world usage of Selection#modify("extend","forward","sentence") is low.
Project Member

Comment 4 by ClusterFuzz, Nov 1 2017

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=5008879057633280.
Project Member

Comment 5 by ClusterFuzz, Nov 2 2017

Labels: Security_Impact-Beta
Detailed report: https://clusterfuzz.com/testcase?key=5008879057633280

Job Type: linux_ubsan_chrome
Crash Type: CHECK failure
Crash Address: 
Crash State:
  start <= end (OUTPUT id="htmlvarNUMBER" style="-webkit-background-origin: border
  blink::TextIteratorAlgorithm<>::TextIteratorAlgorithm
  blink::NextBoundary
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=475811:475824

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5008879057633280

See https://github.com/google/clusterfuzz-tools for more information.
Project Member

Comment 6 by ClusterFuzz, Nov 7 2017

Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/984f4b2c4df57ae840917a1d79f95a54e68e2c7b (Make TextIterator constructor to take only proper range by yosin@chromium.org)https://chromium.googlesource.com/chromium/src/+/fa78f83615f6278ffe657bb6119d1b8339920b36 (Eliminate DocumentMarker and TextMatchMarker copy constructors by rlanday@chromium.org)
If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 7 by ClusterFuzz, Nov 8 2017

Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/984f4b2c4df57ae840917a1d79f95a54e68e2c7b (Make TextIterator constructor to take only proper range by yosin@chromium.org)https://chromium.googlesource.com/chromium/src/+/fa78f83615f6278ffe657bb6119d1b8339920b36 (Eliminate DocumentMarker and TextMatchMarker copy constructors by rlanday@chromium.org)
If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 8 by ClusterFuzz, Nov 8 2017

Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/984f4b2c4df57ae840917a1d79f95a54e68e2c7b (Make TextIterator constructor to take only proper range by yosin@chromium.org)https://chromium.googlesource.com/chromium/src/+/fa78f83615f6278ffe657bb6119d1b8339920b36 (Eliminate DocumentMarker and TextMatchMarker copy constructors by rlanday@chromium.org)
If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 9 by ClusterFuzz, Nov 8 2017

Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/984f4b2c4df57ae840917a1d79f95a54e68e2c7b (Make TextIterator constructor to take only proper range by yosin@chromium.org)https://chromium.googlesource.com/chromium/src/+/fa78f83615f6278ffe657bb6119d1b8339920b36 (Eliminate DocumentMarker and TextMatchMarker copy constructors by rlanday@chromium.org)
If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 10 by ClusterFuzz, Nov 8 2017

Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/984f4b2c4df57ae840917a1d79f95a54e68e2c7b (Make TextIterator constructor to take only proper range by yosin@chromium.org)https://chromium.googlesource.com/chromium/src/+/fa78f83615f6278ffe657bb6119d1b8339920b36 (Eliminate DocumentMarker and TextMatchMarker copy constructors by rlanday@chromium.org)
If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 11 by ClusterFuzz, Nov 8 2017

Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/984f4b2c4df57ae840917a1d79f95a54e68e2c7b (Make TextIterator constructor to take only proper range by yosin@chromium.org)https://chromium.googlesource.com/chromium/src/+/fa78f83615f6278ffe657bb6119d1b8339920b36 (Eliminate DocumentMarker and TextMatchMarker copy constructors by rlanday@chromium.org)
If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 12 by ClusterFuzz, Nov 8 2017

Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/984f4b2c4df57ae840917a1d79f95a54e68e2c7b (Make TextIterator constructor to take only proper range by yosin@chromium.org)https://chromium.googlesource.com/chromium/src/+/fa78f83615f6278ffe657bb6119d1b8339920b36 (Eliminate DocumentMarker and TextMatchMarker copy constructors by rlanday@chromium.org)
If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Please ignore the Test-Predator-Auto-CC comment spam above, there was a bug in our script that caused it to create same comment multiple times and also didn't add ccs properly. 
Project Member

Comment 14 by ClusterFuzz, Nov 30 2017

ClusterFuzz has detected this issue as fixed in range 520042:520054.

Detailed report: https://clusterfuzz.com/testcase?key=5008879057633280

Job Type: linux_ubsan_chrome
Crash Type: CHECK failure
Crash Address: 
Crash State:
  start <= end (OUTPUT id="htmlvarNUMBER" style="-webkit-background-origin: border
  blink::TextIteratorAlgorithm<>::TextIteratorAlgorithm
  blink::NextBoundary
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=475811:475824
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=520042:520054

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5008879057633280

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 15 by ClusterFuzz, Nov 30 2017

ClusterFuzz has detected this issue as fixed in range 520042:520054.

Detailed report: https://clusterfuzz.com/testcase?key=4599428676845568

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  start <= end (OUTPUT id="htmlvarNUMBER" style="-webkit-background-origin: border
  blink::TextIteratorAlgorithm<>::TextIteratorAlgorithm
  blink::NextBoundary
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=475811:475824
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=520042:520054

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4599428676845568

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 16 by ClusterFuzz, Nov 30 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 4599428676845568 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment