Null-dereference in blink::LayoutSlider::UpdateLayout |
|||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6520114706120704 Fuzzer: inferno_layout_test_unmodified Job Type: windows_syzyasan_content_shell Platform Id: windows Crash Type: Null-dereference Crash Address: 0x00000008 Crash State: blink::LayoutSlider::UpdateLayout blink::LayoutBlockFlow::LayoutInlineChildren blink::LayoutBlockFlow::LayoutChildren Memory Tool: SYZYASAN Regressed: https://clusterfuzz.com/revisions?job=windows_syzyasan_content_shell&range=514053:514056 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6520114706120704 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Nov 6 2017
Predator and CL could not provide any possible suspects. Using the code search, Assigning it to the concern owner kojii@ for his recent work on file "LayoutBlockFlowLine.cpp" kojii@ -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes. Thank You.
,
Nov 6 2017
hayato@, could you advice? This repro uses 'internals.shadowRoot' and modifies the inside of UA shadow. I'm thinking this isn't a problem we should worry about, but appreciate your opinion.
,
Nov 7 2017
WONTFIX makes sense. internals.shadowRoot is supported to be used in a test which we can control.
,
Nov 7 2017
ClusterFuzz has detected this issue as fixed in range 514242:514358. Detailed report: https://clusterfuzz.com/testcase?key=6520114706120704 Fuzzer: inferno_layout_test_unmodified Job Type: windows_syzyasan_content_shell Platform Id: windows Crash Type: Null-dereference Crash Address: 0x00000008 Crash State: blink::LayoutSlider::UpdateLayout blink::LayoutBlockFlow::LayoutInlineChildren blink::LayoutBlockFlow::LayoutChildren Memory Tool: SYZYASAN Regressed: https://clusterfuzz.com/revisions?job=windows_syzyasan_content_shell&range=514053:514056 Fixed: https://clusterfuzz.com/revisions?job=windows_syzyasan_content_shell&range=514242:514358 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6520114706120704 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 7 2017
,
Nov 7 2017
,
Nov 7 2017
,
Nov 10 2017
Issue 783053 has been merged into this issue.
,
Nov 14 2017
ClusterFuzz testcase 4994534806388736 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace. |
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by ClusterFuzz
, Nov 5 2017Labels: Test-Predator-AutoComponents