Null-dereference READ in blink::Document::GetSettings |
||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5358172851404800 Fuzzer: ochang_domfuzzer Job Type: windows_asan_content_shell Platform Id: windows Crash Type: Null-dereference READ Crash Address: 0x00000148 Crash State: blink::Document::GetSettings blink::FontSize::FontSizeForKeyword blink::FontBuilder::UpdateFontDescription Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=491007:491035 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5358172851404800 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Oct 7 2017
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/77b3367ad5640838255d942a529ae48e6f67a389 (Adds text rendering support for OffscreenCanvas). If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
,
Oct 9 2017
This doesn't appear related to CSS code. Removing the component.
,
Oct 11 2017
The minimized test case crahes with debug build, but before stepping on null pointer it hits DCHECK(). [1:1:1011/162424.291425:1286567035:FATAL:FontBuilder.cpp(104)] Check failed: document_. #0 0x7f375c5f4dbd base::debug::StackTrace::StackTrace() #1 0x7f375c5f31ec base::debug::StackTrace::StackTrace() #2 0x7f375c6796da logging::LogMessage::~LogMessage() #3 0x7f3754667ea6 blink::FontBuilder::FontSizeForKeyword() #4 0x7f37546691fa blink::FontBuilder::UpdateFontDescription() #5 0x7f3754669fec blink::FontStyleResolver::ComputeFont() #6 0x7f37519e3f67 blink::OffscreenCanvasRenderingContext2D::setFont() #7 0x7f37512ac84d blink::OffscreenCanvasRenderingContext2DV8Internal::fontAttributeSetter() #8 0x7f37512ac771 blink::V8OffscreenCanvasRenderingContext2D::fontAttributeSetterCallback() #9 0x7f375672d2f2 v8::internal::FunctionCallbackArguments::Call() #10 0x7f3756828943 v8::internal::(anonymous namespace)::HandleApiCallHelper<>() #11 0x7f37568271f4 v8::internal::Builtins::InvokeApiFunction() #12 0x7f3756d754ff v8::internal::Object::SetPropertyWithAccessor() #13 0x7f3756d8ca2e v8::internal::Object::SetPropertyInternal() #14 0x7f3756d8c739 v8::internal::Object::SetProperty() #15 0x7f3756c82484 v8::internal::StoreIC::Store() #16 0x7f3756c89200 v8::internal::__RT_impl_Runtime_StoreIC_Miss() #17 0x1c7bc37847e4 <unknown> Fernando, is supporting font rendering on offscreen canvas is work in progress? Maybe merging this bug to issue 722393 is an option??
,
Oct 11 2017
fix on its way.
,
Oct 12 2017
Thanks for the status update!
,
Oct 12 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/9b510c5eb669429160608dcfb582f0193d87a122 commit 9b510c5eb669429160608dcfb582f0193d87a122 Author: Fernando Serboncini <fserb@chromium.org> Date: Thu Oct 12 19:53:50 2017 Allows fontSizeForKeyword to be resolved without document This is needed for OffscreenCanvas (where we have no document). We try to go for reasonable defaults, when there's no document changing settings. Bug: 772589 Change-Id: I9af3a402c1c4936def366b4717c734e07113eceb Reviewed-on: https://chromium-review.googlesource.com/713465 Commit-Queue: Fernando Serboncini <fserb@chromium.org> Reviewed-by: Darren Shen <shend@chromium.org> Cr-Commit-Position: refs/heads/master@{#508398} [modify] https://crrev.com/9b510c5eb669429160608dcfb582f0193d87a122/third_party/WebKit/Source/core/css/FontSize.cpp [modify] https://crrev.com/9b510c5eb669429160608dcfb582f0193d87a122/third_party/WebKit/Source/core/css/resolver/FontBuilder.cpp
,
Oct 13 2017
ClusterFuzz has detected this issue as fixed in range 508379:508465. Detailed report: https://clusterfuzz.com/testcase?key=5358172851404800 Fuzzer: ochang_domfuzzer Job Type: windows_asan_content_shell Platform Id: windows Crash Type: Null-dereference READ Crash Address: 0x00000148 Crash State: blink::Document::GetSettings blink::FontSize::FontSizeForKeyword blink::FontBuilder::UpdateFontDescription Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=491007:491035 Fixed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=508379:508465 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5358172851404800 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Oct 13 2017
ClusterFuzz testcase 5358172851404800 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Nov 7 2017
,
Nov 7 2017
|
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by ClusterFuzz
, Oct 7 2017Labels: Test-Predator-AutoComponents