New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 780686 link

Starred by 1 user

Issue metadata

Status: Verified
Owner: ----
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

InsertParagraph command crashes when BR doesn't have visible position due to unusual styles

Project Member Reported by ClusterFuzz, Nov 2 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5944763839938560

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_ubsan_vptr_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::Node::GetLayoutObject
  blink::InsertParagraphSeparatorCommand::DoApply
  blink::CompositeEditCommand::ApplyCommandToComposite
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=508795:508862

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5944763839938560

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 2 2017

Components: Blink>DOM Blink>Editing
Labels: Test-Predator-AutoComponents
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: msrchandra@chromium.org akariasai@google.com pnangunoori@chromium.org
Labels: M-64 Test-Predator-Wrong
Owner: xiaoche...@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using the code search for the file, “InsertParagraphSeparatorCommand.cpp” assigning to concern owner from GIT revision log.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/b2c7a344d7f8ef4de77dd87428560a4da95f0918

@xiaochengh -- Could you please look into this issue, kindly reassign if it has nothing to do with the changes.

Assigning the issue to the reviewer as unable to assign the issue to the actual suspect.

Thank You.

Components: -Blink>Editing -Blink>DOM Blink>Editing>Command
Labels: -Pri-1 Pri-3
Owner: ----
Status: Available (was: Assigned)
Summary: InsertParagraph command crashes when BR doesn't have visible position due to unusual styles (was: Null-dereference READ in blink::Node::GetLayoutObject)
CreateVisiblePosition(Position::InParentAfterNode(*br)) failed to create a non-null VisiblePosition due to styles of <br> like 'visibility: collapse' that are not usually applied to <br>.

Deprioritize to P3 since it's not regression.
Labels: Test-Predator-Auto-CC
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
Labels: -Test-Predator-Auto-CC
Project Member

Comment 7 by ClusterFuzz, Dec 6 2017

ClusterFuzz has detected this issue as fixed in range 522010:522026.

Detailed report: https://clusterfuzz.com/testcase?key=5944763839938560

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_ubsan_vptr_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::Node::GetLayoutObject
  blink::InsertParagraphSeparatorCommand::DoApply
  blink::CompositeEditCommand::ApplyCommandToComposite
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=508795:508862
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=522010:522026

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5944763839938560

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Dec 6 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 5944763839938560 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment