New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 768121 link

Starred by 1 user

Issue metadata

Status: Duplicate
Owner:
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: !node || IsElementOfType<const T>(*node) in Element.h

Project Member Reported by ClusterFuzz, Sep 23 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5454883787636736

Fuzzer: inferno_twister
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !node || IsElementOfType<const T>(*node) in Element.h
  blink::HTMLDetailsElement::FindMainSummary
  blink::HTMLSummaryElement::IsMainSummary
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=471126:471172

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5454883787636736

Additional requirements: Requires Gestures

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Sep 23 2017

Labels: OS-Linux
Cc: msrchandra@chromium.org kbr@chromium.org jiajia....@intel.com pnangunoori@chromium.org
Labels: M-62 Test-Predator-Correct
Owner: zmo@chromium.org
Status: Assigned (was: Untriaged)
Test Predator has given the following results:

Remove non-target version of copyVideoTextureToPlatformTexture by jiajia.qin@intel.com
Changed files HTMLVideoElement.cpp, HTMLVideoElement.h, with the same CrashedDirectory(third_party/WebKit/Source/core/html) as HTMLDetailsElement.cpp (in frame#2), HTMLSummaryElement.cpp (in frame#3)
Changed files HTMLVideoElement.cpp, HTMLVideoElement.h, with the same CrashedComponent(Blink>HTML) as DetailsMarkerControl.cpp (in frame#4), HTMLDetailsElement.cpp (in frame#2), HTMLSummaryElement.cpp (in frame#3)

Assigning this issue to @zmo as author for this commit is from Intel.

@zmo  -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.

Thank You.
Project Member

Comment 3 by ClusterFuzz, Sep 26 2017

Labels: OS-Mac

Comment 4 by kbr@chromium.org, Sep 26 2017

Cc: zmo@chromium.org
Components: Blink>SVG Blink>DOM>ShadowDOM
Owner: ----
Status: Available (was: Assigned)
The automated analysis must be wrong. This Clusterfuzz test case uses a bunch of invalid HTML involving Shadow DOM and SVG filter effects; it doesn't use video. Unassigning Mo and adding a couple of probably-related components.

Owner: schenney@chromium.org
Status: Assigned (was: Available)
Project Member

Comment 6 by ClusterFuzz, Oct 1 2017

Components: Blink>HTML
Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.
Components: -Blink>HTML -Blink>DOM>ShadowDOM
Components: -Blink>SVG Blink>DOM>ShadowDOM
Owner: ----
Status: Untriaged (was: Assigned)
Confirmed it crashes in content_shell Debug without Asan or any gesture. But it's all shadow DOM stack.
Cc: tkent@chromium.org
Owner: hayato@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using the code search for the file, “Element.h” assigning to concern owner from GIT blame.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/bc7fac71c125e9c34e2079222816291bbbb10712
@hayato -- Could you please look into this issue as tkent@ is OOO, kindly reassign if it has nothing to do with this changes.

Thank You.

Mergedinto: 580734
Status: Duplicate (was: Assigned)
Project Member

Comment 11 by ClusterFuzz, Oct 20 2017

ClusterFuzz has detected this issue as fixed in range 510178:510268.

Detailed report: https://clusterfuzz.com/testcase?key=5454883787636736

Fuzzer: inferno_twister
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !node || IsElementOfType<const T>(*node) in Element.h
  blink::HTMLDetailsElement::FindMainSummary
  blink::HTMLSummaryElement::IsMainSummary
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=471126:471172
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=510178:510268

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5454883787636736

Additional requirements: Requires Gestures

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components

Sign in to add a comment