FormatBlock crashes with unusual HTML containing SVG |
||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4831739850784768 Fuzzer: inferno_layout_test_unmodified Job Type: linux_lsan_chrome_mp Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000010 Crash State: GetFlag isConnected blink::Node::IsDescendantOf Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=297214:297254 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4831739850784768 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Oct 9 2017
Unable to provide possible suspect using Predator, CL and Code Search. Could someone please look into the issue. Thank You.
,
Oct 10 2017
With debug build and the minimized test case from clustefuzz, I got the following backtrace: [1:1:1010/173441.749787:710971728942:FATAL:EditingUtilities.cpp(291)] Check failed: a.IsNotNull(). #0 0x7fe639659dbd base::debug::StackTrace::StackTrace() #1 0x7fe6396581ec base::debug::StackTrace::StackTrace() #2 0x7fe6396de8ba logging::LogMessage::~LogMessage() #3 0x7fe631a298f3 blink::ComparePositions() #4 0x7fe631ada6af blink::CompositeEditCommand::MoveParagraphWithClones() #5 0x7fe631af5403 blink::FormatBlockCommand::FormatRange() #6 0x7fe631abebca blink::ApplyBlockElementCommand::FormatSelection() #7 0x7fe631af4cf8 blink::FormatBlockCommand::FormatSelection() #8 0x7fe631abe315 blink::ApplyBlockElementCommand::DoApply() #9 0x7fe631ad2c6d blink::CompositeEditCommand::Apply() #10 0x7fe631aed623 blink::ExecuteFormatBlock() #11 0x7fe631aead59 blink::Editor::Command::Execute() #12 0x7fe631ae9223 blink::Document::execCommand() #13 0x7fe632a60f36 blink::DocumentV8Internal::execCommandMethod() #14 0x7fe632a60417 blink::V8Document::execCommandMethodCallback() #15 0x7fe6338a22f2 v8::internal::FunctionCallbackArguments::Call() #16 0x7fe63399d8f3 v8::internal::(anonymous namespace)::HandleApiCallHelper<>() #17 0x7fe63399bae3 v8::internal::Builtin_Impl_HandleApiCall() #18 0x7fe63399b4ad v8::internal::Builtin_HandleApiCall() #19 0x2ff950a047e4 <unknown> Forwarding to Editing team.
,
Oct 10 2017
Lower to Pri-3 since real world usage of "FormatBlock" command is low.
,
Nov 7 2017
,
Nov 7 2017
Automatically adding ccs based on suspected regression changelists: https://chromium.googlesource.com/chromium/src/+/ae846887d618ba498e64d79de606c8851e62f6da (Add base::Reversed() as an adapter for range-based for loops in reverse by mdempsky@chromium.org)https://chromium.googlesource.com/chromium/src/+/767ea6b133ce5e1818ac6f41c6210ba073a686b4 (Cleanup. by pkasting@chromium.org)https://chromium.googlesource.com/chromium/src/+/a772c842fc3107346666ba7884e2d062fa6a5537 (cc:: Remove main_frame_before_draw_enabled from scheduler settings. by orglofch@chromium.org) If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
,
Nov 8 2017
Automatically adding ccs based on suspected regression changelists: https://chromium.googlesource.com/chromium/src/+/ae846887d618ba498e64d79de606c8851e62f6da (Add base::Reversed() as an adapter for range-based for loops in reverse by mdempsky@chromium.org)https://chromium.googlesource.com/chromium/src/+/767ea6b133ce5e1818ac6f41c6210ba073a686b4 (Cleanup. by pkasting@chromium.org)https://chromium.googlesource.com/chromium/src/+/a772c842fc3107346666ba7884e2d062fa6a5537 (cc:: Remove main_frame_before_draw_enabled from scheduler settings. by orglofch@chromium.org) If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
,
Nov 8 2017
Automatically adding ccs based on suspected regression changelists: https://chromium.googlesource.com/chromium/src/+/ae846887d618ba498e64d79de606c8851e62f6da (Add base::Reversed() as an adapter for range-based for loops in reverse by mdempsky@chromium.org)https://chromium.googlesource.com/chromium/src/+/767ea6b133ce5e1818ac6f41c6210ba073a686b4 (Cleanup. by pkasting@chromium.org)https://chromium.googlesource.com/chromium/src/+/a772c842fc3107346666ba7884e2d062fa6a5537 (cc:: Remove main_frame_before_draw_enabled from scheduler settings. by orglofch@chromium.org) If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
,
Nov 8 2017
Automatically adding ccs based on suspected regression changelists: https://chromium.googlesource.com/chromium/src/+/ae846887d618ba498e64d79de606c8851e62f6da (Add base::Reversed() as an adapter for range-based for loops in reverse by mdempsky@chromium.org)https://chromium.googlesource.com/chromium/src/+/767ea6b133ce5e1818ac6f41c6210ba073a686b4 (Cleanup. by pkasting@chromium.org)https://chromium.googlesource.com/chromium/src/+/a772c842fc3107346666ba7884e2d062fa6a5537 (cc:: Remove main_frame_before_draw_enabled from scheduler settings. by orglofch@chromium.org) If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
,
Nov 8 2017
Automatically adding ccs based on suspected regression changelists: https://chromium.googlesource.com/chromium/src/+/ae846887d618ba498e64d79de606c8851e62f6da (Add base::Reversed() as an adapter for range-based for loops in reverse by mdempsky@chromium.org)https://chromium.googlesource.com/chromium/src/+/767ea6b133ce5e1818ac6f41c6210ba073a686b4 (Cleanup. by pkasting@chromium.org)https://chromium.googlesource.com/chromium/src/+/a772c842fc3107346666ba7884e2d062fa6a5537 (cc:: Remove main_frame_before_draw_enabled from scheduler settings. by orglofch@chromium.org) If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
,
Nov 8 2017
Automatically adding ccs based on suspected regression changelists: https://chromium.googlesource.com/chromium/src/+/ae846887d618ba498e64d79de606c8851e62f6da (Add base::Reversed() as an adapter for range-based for loops in reverse by mdempsky@chromium.org)https://chromium.googlesource.com/chromium/src/+/767ea6b133ce5e1818ac6f41c6210ba073a686b4 (Cleanup. by pkasting@chromium.org)https://chromium.googlesource.com/chromium/src/+/a772c842fc3107346666ba7884e2d062fa6a5537 (cc:: Remove main_frame_before_draw_enabled from scheduler settings. by orglofch@chromium.org) If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
,
Nov 8 2017
Automatically adding ccs based on suspected regression changelists: https://chromium.googlesource.com/chromium/src/+/ae846887d618ba498e64d79de606c8851e62f6da (Add base::Reversed() as an adapter for range-based for loops in reverse by mdempsky@chromium.org)https://chromium.googlesource.com/chromium/src/+/767ea6b133ce5e1818ac6f41c6210ba073a686b4 (Cleanup. by pkasting@chromium.org)https://chromium.googlesource.com/chromium/src/+/a772c842fc3107346666ba7884e2d062fa6a5537 (cc:: Remove main_frame_before_draw_enabled from scheduler settings. by orglofch@chromium.org) If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
,
Nov 8 2017
Please ignore the Test-Predator-Auto-CC comment spam above, there was a bug in our script that caused it to create same comment multiple times and also didn't add ccs properly.
,
Nov 16 2017
,
Dec 22 2017
ClusterFuzz has detected this issue as fixed in range 525936:525937. Detailed report: https://clusterfuzz.com/testcase?key=4831739850784768 Fuzzer: inferno_layout_test_unmodified Job Type: linux_lsan_chrome_mp Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000010 Crash State: GetFlag isConnected blink::Node::IsDescendantOf Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=297214:297254 Fixed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=525936:525937 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4831739850784768 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Dec 22 2017
ClusterFuzz testcase 4831739850784768 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by ClusterFuzz
, Oct 6 2017Labels: Test-Predator-AutoComponents