As this is a null-ptr deref, lowering the priority to P2.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/f24a21c25dd45feb95fdf9bece7a589ab1126532 (Add class level comments to LayoutTreeBuilder).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

My CL adds comments only

Simpler reproduction case.

I think there are actually 2 bugs here.

1 is that we don't check for a valid body before calling SetIntegralAttribute the second time in Document::WillChangeFrameOwnerProperties.

2 is that we log an uncaught exception from

  html_div.appendChild(html_iframe.contentDocument.body);

but the append actually happens and it leaves html_iframe.contentDocument.body null. The call should either fail for real or succeed cleanly (not sure if I will dig in any further into that one).

Deleted: clusterfuzz-simpler.html 670 bytes

clusterfuzz-simpler.html 670 bytes View Download

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7d8f1e30e8d6918f4da3657e03be88d555deccd8

commit 7d8f1e30e8d6918f4da3657e03be88d555deccd8
Author: Fergal Daly <fergal@chromium.org>
Date: Fri Jan 19 09:46:19 2018

Prevent null dereference on body.

BUG: Document::WillChangeFrameOwnerProperties checks whether body() is
null once but calls 2 methods on it. Mutation event listeners can
cause body() to become null during the first call, leading to a crash
in the secondcall.

FIX: Check body() for nullness before each call.

This is not a critical fix but clusterfuzz has filed at least 2 bugs
that trigger the same problem and the fix is simple.


Bug:  778956 
Change-Id: I1fdef6bea392999f19a326ed12d66e4b40c98a90
Reviewed-on: https://chromium-review.googlesource.com/872474
Commit-Queue: Fergal Daly <fergal@chromium.org>
Reviewed-by: Hayato Ito <hayato@chromium.org>
Cr-Commit-Position: refs/heads/master@{#530463}
[add] https://crrev.com/7d8f1e30e8d6918f4da3657e03be88d555deccd8/third_party/WebKit/LayoutTests/fast/dom/margin-height-guarded-crash-expected.txt
[add] https://crrev.com/7d8f1e30e8d6918f4da3657e03be88d555deccd8/third_party/WebKit/LayoutTests/fast/dom/margin-height-guarded-crash.html
[modify] https://crrev.com/7d8f1e30e8d6918f4da3657e03be88d555deccd8/third_party/WebKit/Source/core/dom/Document.cpp

 Issue 797177  has been merged into this issue.

 Issue 723217  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 530462:530464.

Detailed report: https://clusterfuzz.com/testcase?key=6271083283218432

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000058
Crash State:
  blink::Element::setAttribute
  blink::Element::SetIntegralAttribute
  blink::Document::WillChangeFrameOwnerProperties
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=473072:473106
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=530462:530464

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6271083283218432

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6271083283218432 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

 Issue 781029  has been merged into this issue.