InsertText command crashes with unusual HTML |
||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5527320994775040 Fuzzer: inferno_layout_test_unmodified Job Type: windows_syzyasan_chrome Platform Id: windows Crash Type: Null-dereference Crash Address: 0x0000000b Crash State: blink::Node::ContainsIncludingHostElements blink::ComputePositionForChildrenRemoval blink::SelectionEditor::NodeChildrenWillBeRemoved Memory Tool: SYZYASAN Regressed: https://clusterfuzz.com/revisions?job=windows_syzyasan_chrome&range=483672:483687 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5527320994775040 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Oct 5 2017
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/7c44da721a59e6aa0b9fdcddb314175cb1e0123f (Implement lazy (re-)attachment of whitespace.). If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
,
Oct 11 2017
With the minimized case with debug build, it hit DCHECK() before setpping on the null pointer: [1:1:1011/161912.735013:975010647:FATAL:SelectionTemplate.cpp(257)] Check failed: position.IsConnected(). #text "[(\"<lc]mmmmw4444444444444&&&111$"@offsetInAnchor[0] #0 0x7fcd503fbdbd base::debug::StackTrace::StackTrace() #1 0x7fcd503fa1ec base::debug::StackTrace::StackTrace() #2 0x7fcd504806da logging::LogMessage::~LogMessage() #3 0x7fcd48719300 blink::SelectionTemplate<>::Builder::Collapse() #4 0x7fcd4871a4e7 blink::SelectionTemplate<>::Builder::SetBaseAndExtent() #5 0x7fcd4872f4b9 blink::VisibleSelectionTemplate<>::AsSelection() #6 0x7fcd4876ccd1 blink::CompositeEditCommand::SetEndingVisibleSelection() #7 0x7fcd487a8e28 blink::TypingCommand::InsertText() #8 0x7fcd487a8853 blink::TypingCommand::InsertText() #9 0x7fcd4877ee69 blink::ExecuteInsertText() #10 0x7fcd4877b309 blink::Editor::Command::Execute() #11 0x7fcd487797d3 blink::Document::execCommand() #12 0x7fcd496f2556 blink::DocumentV8Internal::execCommandMethod() #13 0x7fcd496f1a37 blink::V8Document::execCommandMethodCallback() #14 0x7fcd4a5342f2 v8::internal::FunctionCallbackArguments::Call() #15 0x7fcd4a62f943 v8::internal::(anonymous namespace)::HandleApiCallHelper<>() #16 0x7fcd4a62db33 v8::internal::Builtin_Impl_HandleApiCall() #17 0x7fcd4a62d4fd v8::internal::Builtin_HandleApiCall() #18 0x3e9665d847e4 <unknown> Given the backtrace, forwarding this to Blink>Editing.
,
Oct 19 2017
The assigned owner "rune@opera.com" is not able to receive e-mails, please re-triage. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 19 2017
,
Oct 25 2017
Lower to Pri-3 because real world usage of InsertText command with unusual HTML is low.
,
Nov 7 2017
,
Nov 7 2017
,
Nov 8 2017
,
Dec 6 2017
ClusterFuzz has detected this issue as fixed in range 521421:521451. Detailed report: https://clusterfuzz.com/testcase?key=5527320994775040 Fuzzer: inferno_layout_test_unmodified Job Type: windows_asan_chrome Platform Id: windows Crash Type: Null-dereference Crash Address: 0x0000000b Crash State: blink::Node::ContainsIncludingHostElements blink::ComputePositionForChildrenRemoval blink::SelectionEditor::NodeChildrenWillBeRemoved Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=483672:483687 Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=521421:521451 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5527320994775040 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Dec 6 2017
ClusterFuzz testcase 5527320994775040 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||||||
►
Sign in to add a comment |
||||||||||
Comment 1 by ClusterFuzz
, Oct 5 2017Labels: Test-Predator-AutoComponents