New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 768301 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::Element::Shadow

Project Member Reported by ClusterFuzz, Sep 25 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4556906655121408

Fuzzer: inferno_twister
Job Type: windows_asan_chrome
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x00000008
Crash State:
  blink::Element::Shadow
  blink::ShadowWhereNodeCanBeDistributedForV0
  blink::Element::AttributeChanged
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=502136:502169

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4556906655121408

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: msrchandra@chromium.org kkaluri@chromium.org
Labels: Test-Predator-Wrong CF-NeedsTriage M-63
Unable to find the possible suspect using Predator, CL and Code Search.Hence untriaging this issue, Could some one please look into the issue.

Thank You.
Project Member

Comment 2 by ClusterFuzz, Oct 1 2017

Components: Blink>DOM
Labels: Test-Predator-AutoComponents
Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 3 by kochi@chromium.org, Oct 2 2017

Owner: kochi@chromium.org
Status: Assigned (was: Untriaged)
Reproduces for me.

Comment 4 by kochi@chromium.org, Oct 12 2017

Status: Started (was: Assigned)
With debug builds, before getting to Element::Shadow, the testcase hits
DCHECK in ContainerNode.cpp.

[1:1:1012/185438.329425:96700605070:FATAL:ContainerNode.cpp(314)] Check failed: !target_node->parentNode(). 
#0 0x7fd7659c4dbd base::debug::StackTrace::StackTrace()
#1 0x7fd7659c31ec base::debug::StackTrace::StackTrace()
#2 0x7fd765a49f7a logging::LogMessage::~LogMessage()
#3 0x7fd75daa2f36 blink::ContainerNode::InsertNodeVector<>()
#4 0x7fd75da9b437 blink::ContainerNode::AppendChild()
#5 0x7fd75dba41ea blink::Node::appendChild()
#6 0x7fd75ece77c6 blink::NodeV8Internal::appendChildMethodForMainWorld()
#7 0x7fd75ece7487 blink::V8Node::appendChildMethodCallbackForMainWorld()
#8 0x7fd75fade2f2 v8::internal::FunctionCallbackArguments::Call()
#9 0x7fd75fbd99b3 v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
#10 0x7fd75fbd7ba3 v8::internal::Builtin_Impl_HandleApiCall()
#11 0x7fd75fbd756d v8::internal::Builtin_HandleApiCall()
#12 0x29b70cc847e4 <unknown>

Comment 5 by kochi@chromium.org, Oct 26 2017

Labels: -Pri-1 Pri-2
Status: Assigned (was: Started)
As the testcase uses createShadowRoot() which is Shadow DOM V0 API,
lowering the priority.
Project Member

Comment 6 by ClusterFuzz, Oct 27 2017

ClusterFuzz has detected this issue as fixed in range 512010:512063.

Detailed report: https://clusterfuzz.com/testcase?key=4556906655121408

Fuzzer: inferno_twister
Job Type: windows_asan_chrome
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x00000008
Crash State:
  blink::Element::Shadow
  blink::ShadowWhereNodeCanBeDistributedForV0
  blink::Element::AttributeChanged
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=502136:502169
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=512010:512063

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4556906655121408

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Oct 27 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4556906655121408 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components

Sign in to add a comment