Null-dereference READ in blink::UnderlyingSourceBase::cancelWrapper |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5020258841919488 Fuzzer: inferno_twister Job Type: linux_asan_chrome_chromeos Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000008 Crash State: blink::UnderlyingSourceBase::cancelWrapper blink::V8UnderlyingSourceBase::cancelMethodCallback v8::internal::FunctionCallbackArguments::Call Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=420849:420857 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5020258841919488 Additional requirements: Requires HTTP Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Nov 20 2017
Looks like the same stack as issue 784110 : #0 0x7f327d3d90a6 in IsEmpty v8/include/v8.h:507:43 #1 0x7f327d3d90a6 in Reset v8/include/v8.h:9359 #2 0x7f327d3d90a6 in Clear third_party/WebKit/Source/platform/bindings/ScopedPersistent.h:93 #3 0x7f327d3d90a6 in NoteHasBeenCanceled third_party/WebKit/Source/core/streams/ReadableStreamController.h:35 #4 0x7f327d3d90a6 in blink::UnderlyingSourceBase::cancelWrapper(blink::ScriptState*, blink::ScriptValue) third_party/WebKit/Source/core/streams/UnderlyingSourceBase.cpp:36 #5 0x7f327cf3263c in cancelMethod out/Release/gen/blink/bindings/core/v8/V8UnderlyingSourceBase.cpp:132:32 #6 0x7f327cf3263c in blink::V8UnderlyingSourceBase::cancelMethodCallback(v8::FunctionCallbackInfo<v8::Value> const&) out/Release/gen/blink/bindings/core/v8/V8UnderlyingSourceBase.cpp:165 #7 0x7f3267d43fd0 in v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo<v8::Value> const&)) v8/src/api-arguments.cc:25:3 #8 0x7f3267f49de0 in v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) v8/src/builtins/builtins-api.cc:112:36 #9 0x7f3267f47512 in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-api.cc:142:5 #5 0x7f322c204cdc (<unknown module>)
,
Nov 21 2017
ClusterFuzz has detected this issue as fixed in range 514498:517889. Detailed report: https://clusterfuzz.com/testcase?key=5020258841919488 Fuzzer: inferno_twister Job Type: linux_asan_chrome_chromeos Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000008 Crash State: blink::UnderlyingSourceBase::cancelWrapper blink::V8UnderlyingSourceBase::cancelMethodCallback v8::internal::FunctionCallbackArguments::Call Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=420849:420857 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=514498:517889 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5020258841919488 Additional requirements: Requires HTTP See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 21 2017
ClusterFuzz testcase 5020258841919488 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by ClusterFuzz
, Nov 20 2017Labels: Test-Predator-Auto-Components