Null-dereference in blink::LocalFrameView::ScheduleVisualUpdateForPaintInvalidationIfNeeded |
|||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5992571053801472 Fuzzer: inferno_twister_c Job Type: windows_syzyasan_chrome Platform Id: windows Crash Type: Null-dereference Crash Address: 0x00000077 Crash State: blink::LocalFrameView::ScheduleVisualUpdateForPaintInvalidationIfNeeded blink::LayoutObject::SetShouldDoFullPaintInvalidationWithoutGeometryChange blink::LayoutObject::SetShouldDoFullPaintInvalidation Memory Tool: SYZYASAN Regressed: https://clusterfuzz.com/revisions?job=windows_syzyasan_chrome&range=483256:483281 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5992571053801472 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Nov 21 2017
Predator and CL could not provide any possible suspects. Using the code search for the file, “layoutobject.cpp” assigning to concern owner. Suspecting Commit# https://chromium.googlesource.com/chromium/src/+/2cff87c380b22ade36aa4d85a6f983387559178c chrishtr@-- Could you please look into this issue, kindly reassign if it has nothing to do with your changes. Thank You...
,
Nov 29 2017
The underlying bug here is that the use of document.adoptNode and DOMImplementation::createDocument leads to a case that a lot of Blink code doesn't expect - (a) the document returned by the latter document has no LocalFrameView, and even when several of those callsites are patched up, there is a crash in a DCHECK in ContainerNode about parentNode being expected to be null. Sending to the DOM component for analysis about what to do.
,
Dec 1 2017
Predator and CL could not provide any possible suspects. Using the code search for the file, “localframeview.cpp” assigning to concern owner from GIT blame. Suspecting Commit# https://chromium.googlesource.com/chromium/src/+/6a5f851291ddd77204a5c18dd72d5fc7c1d30291 @joelhockey -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes. Thank You.
,
Dec 1 2017
As far as I can tell, this is nothing to do with my renaming CL or other changes I have made. Setting status to Untriaged.
,
Dec 1 2017
,
Dec 4 2017
Unable to provide possible suspect using Predator, CL and Code Search. Could someone please look into the issue. Thank You.
,
Dec 11 2017
This is a nullptr deref and would not be a security issue, and is not a regression, deprioritizing.
,
Sep 26
This reprod on Linux @542740 built with AsanRel but does not repro anymore, so I am closing it.
,
Sep 26
|
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by ClusterFuzz
, Nov 20 2017Labels: Test-Predator-Auto-Components