New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 772589 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::Document::GetSettings

Project Member Reported by ClusterFuzz, Oct 7 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5358172851404800

Fuzzer: ochang_domfuzzer
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x00000148
Crash State:
  blink::Document::GetSettings
  blink::FontSize::FontSizeForKeyword
  blink::FontBuilder::UpdateFontDescription
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=491007:491035

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5358172851404800

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 7 2017

Components: Blink>CSS Blink>DOM
Labels: Test-Predator-AutoComponents
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Oct 7 2017

Labels: Test-Predator-AutoOwner
Owner: fs...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/77b3367ad5640838255d942a529ae48e6f67a389 (Adds text rendering support for OffscreenCanvas).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

Comment 3 by shend@chromium.org, Oct 9 2017

Components: -Blink>CSS
This doesn't appear related to CSS code. Removing the component.

Comment 4 by kochi@chromium.org, Oct 11 2017

Cc: kochi@chromium.org
Components: -Blink>DOM Blink>Canvas Blink>Fonts
The minimized test case crahes with debug build, but before stepping on
null pointer it hits DCHECK().

[1:1:1011/162424.291425:1286567035:FATAL:FontBuilder.cpp(104)] Check failed: document_. 
#0 0x7f375c5f4dbd base::debug::StackTrace::StackTrace()
#1 0x7f375c5f31ec base::debug::StackTrace::StackTrace()
#2 0x7f375c6796da logging::LogMessage::~LogMessage()
#3 0x7f3754667ea6 blink::FontBuilder::FontSizeForKeyword()
#4 0x7f37546691fa blink::FontBuilder::UpdateFontDescription()
#5 0x7f3754669fec blink::FontStyleResolver::ComputeFont()
#6 0x7f37519e3f67 blink::OffscreenCanvasRenderingContext2D::setFont()
#7 0x7f37512ac84d blink::OffscreenCanvasRenderingContext2DV8Internal::fontAttributeSetter()
#8 0x7f37512ac771 blink::V8OffscreenCanvasRenderingContext2D::fontAttributeSetterCallback()
#9 0x7f375672d2f2 v8::internal::FunctionCallbackArguments::Call()
#10 0x7f3756828943 v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
#11 0x7f37568271f4 v8::internal::Builtins::InvokeApiFunction()
#12 0x7f3756d754ff v8::internal::Object::SetPropertyWithAccessor()
#13 0x7f3756d8ca2e v8::internal::Object::SetPropertyInternal()
#14 0x7f3756d8c739 v8::internal::Object::SetProperty()
#15 0x7f3756c82484 v8::internal::StoreIC::Store()
#16 0x7f3756c89200 v8::internal::__RT_impl_Runtime_StoreIC_Miss()
#17 0x1c7bc37847e4 <unknown>

Fernando, is supporting font rendering on offscreen canvas is work in progress?
Maybe merging this bug to  issue 722393  is an option??

Comment 5 by fs...@chromium.org, Oct 11 2017

Status: Started (was: Assigned)
fix on its way.

Comment 6 by kochi@chromium.org, Oct 12 2017

Thanks for the status update!
Project Member

Comment 7 by bugdroid1@chromium.org, Oct 12 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9b510c5eb669429160608dcfb582f0193d87a122

commit 9b510c5eb669429160608dcfb582f0193d87a122
Author: Fernando Serboncini <fserb@chromium.org>
Date: Thu Oct 12 19:53:50 2017

Allows fontSizeForKeyword to be resolved without document

This is needed for OffscreenCanvas (where we have no document).
We try to go for reasonable defaults, when there's no document changing
settings.

Bug:  772589 
Change-Id: I9af3a402c1c4936def366b4717c734e07113eceb
Reviewed-on: https://chromium-review.googlesource.com/713465
Commit-Queue: Fernando Serboncini <fserb@chromium.org>
Reviewed-by: Darren Shen <shend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#508398}
[modify] https://crrev.com/9b510c5eb669429160608dcfb582f0193d87a122/third_party/WebKit/Source/core/css/FontSize.cpp
[modify] https://crrev.com/9b510c5eb669429160608dcfb582f0193d87a122/third_party/WebKit/Source/core/css/resolver/FontBuilder.cpp

Project Member

Comment 8 by ClusterFuzz, Oct 13 2017

ClusterFuzz has detected this issue as fixed in range 508379:508465.

Detailed report: https://clusterfuzz.com/testcase?key=5358172851404800

Fuzzer: ochang_domfuzzer
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x00000148
Crash State:
  blink::Document::GetSettings
  blink::FontSize::FontSizeForKeyword
  blink::FontBuilder::UpdateFontDescription
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=491007:491035
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=508379:508465

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5358172851404800

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Oct 13 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 5358172851404800 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
Labels: -Test-Predator-AutoOwner Test-Predator-Auto-Owner

Sign in to add a comment