New issue
Advanced search Search tips

Issue 786932 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::UnderlyingSourceBase::cancelWrapper

Project Member Reported by ClusterFuzz, Nov 20 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5020258841919488

Fuzzer: inferno_twister
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000008
Crash State:
  blink::UnderlyingSourceBase::cancelWrapper
  blink::V8UnderlyingSourceBase::cancelMethodCallback
  v8::internal::FunctionCallbackArguments::Call
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=420849:420857

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5020258841919488

Additional requirements: Requires HTTP

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 20 2017

Components: Blink>Network>StreamsAPI
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 2 by ricea@chromium.org, Nov 20 2017

Owner: yhirano@chromium.org
Status: Assigned (was: Untriaged)
Looks like the same stack as  issue 784110 :

#0 0x7f327d3d90a6 in IsEmpty v8/include/v8.h:507:43
#1 0x7f327d3d90a6 in Reset v8/include/v8.h:9359
#2 0x7f327d3d90a6 in Clear third_party/WebKit/Source/platform/bindings/ScopedPersistent.h:93
#3 0x7f327d3d90a6 in NoteHasBeenCanceled third_party/WebKit/Source/core/streams/ReadableStreamController.h:35
 #4 0x7f327d3d90a6 in blink::UnderlyingSourceBase::cancelWrapper(blink::ScriptState*, blink::ScriptValue) third_party/WebKit/Source/core/streams/UnderlyingSourceBase.cpp:36
#5 0x7f327cf3263c in cancelMethod out/Release/gen/blink/bindings/core/v8/V8UnderlyingSourceBase.cpp:132:32
 #6 0x7f327cf3263c in blink::V8UnderlyingSourceBase::cancelMethodCallback(v8::FunctionCallbackInfo<v8::Value> const&) out/Release/gen/blink/bindings/core/v8/V8UnderlyingSourceBase.cpp:165
 #7 0x7f3267d43fd0 in v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo<v8::Value> const&)) v8/src/api-arguments.cc:25:3
#8 0x7f3267f49de0 in v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) v8/src/builtins/builtins-api.cc:112:36
#9 0x7f3267f47512 in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-api.cc:142:5
#5 0x7f322c204cdc  (<unknown module>)
Project Member

Comment 3 by ClusterFuzz, Nov 21 2017

ClusterFuzz has detected this issue as fixed in range 514498:517889.

Detailed report: https://clusterfuzz.com/testcase?key=5020258841919488

Fuzzer: inferno_twister
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000008
Crash State:
  blink::UnderlyingSourceBase::cancelWrapper
  blink::V8UnderlyingSourceBase::cancelMethodCallback
  v8::internal::FunctionCallbackArguments::Call
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=420849:420857
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=514498:517889

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5020258841919488

Additional requirements: Requires HTTP

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Nov 21 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5020258841919488 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment