New issue
Advanced search Search tips

Issue 787764 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::ComputeInlineBoxPositionForAtomicInline

Project Member Reported by ClusterFuzz, Nov 22 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5935291591557120

Fuzzer: bj_broddelwerk
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::ComputeInlineBoxPositionForAtomicInline
  blink::InlineBoxPosition blink::ComputeInlineBoxPositionTemplate<blink::EditingA
  blink::LocalCaretRect blink::LocalCaretRectOfPositionTemplate<blink::EditingAlgo
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=518061:518147

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5935291591557120

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 22 2017

Components: Blink>Editing
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Nov 22 2017

Cc: xiaoche...@chromium.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Revert "Get rid of redundant call of SetIsDirectional() in SelectionController::SetNonDirectionalSelectionIfNeeded()" by xiaochengh@chromium.org - https://chromium.googlesource.com/chromium/src/+/217d5aa0eba9d6e74f54712b1c1c5197442d5738

Final preparation for adding DCHECK(CanUseInlineBox) in ComputeInlineBoxPosition() by xiaochengh@chromium.org - https://chromium.googlesource.com/chromium/src/+/12aa0c6679bd58808cd87106e2bd41cba9912858

If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Cc: -xiaoche...@chromium.org
Owner: xiaoche...@chromium.org
Status: Assigned (was: Untriaged)
Whoops. I made a wrong assumption when refactoring this function.
Project Member

Comment 4 by bugdroid1@chromium.org, Nov 22 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1f1cab54da2c7eca322543b7f61710fc5f1e3b15

commit 1f1cab54da2c7eca322543b7f61710fc5f1e3b15
Author: Xiaocheng Hu <xiaochengh@chromium.org>
Date: Wed Nov 22 21:08:09 2017

Revert "Final preparation for adding DCHECK(CanUseInlineBox) in ComputeInlineBoxPosition()"

This reverts commit 12aa0c6679bd58808cd87106e2bd41cba9912858.

Reason for revert: causing  crbug.com/787764 

Original change's description:
> Final preparation for adding DCHECK(CanUseInlineBox) in ComputeInlineBoxPosition()
> 
> This patch further refactors ComputeInlineBoxPositionForAtomicInline(),
> so that it is now straightforward to add DCHECK(CanUseInlineBox) into
> the code to trach usage of legacy inline boxes.
> 
> Bug: 771398
> Change-Id: I3a3e839ebbc489cd2fa251259fe94921bf25de15
> Reviewed-on: https://chromium-review.googlesource.com/780365
> Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
> Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#518123}

TBR=yosin@chromium.org,yoichio@chromium.org,kojii@chromium.org,xiaochengh@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: 771398,  787764 
Change-Id: I86b044132e4ed5472641e9e3674bdae71a9455e5
Reviewed-on: https://chromium-review.googlesource.com/786451
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#518744}
[modify] https://crrev.com/1f1cab54da2c7eca322543b7f61710fc5f1e3b15/third_party/WebKit/Source/core/editing/InlineBoxPosition.cpp

Cc: xiaoche...@chromium.org
 Issue 788054  has been merged into this issue.
Project Member

Comment 6 by ClusterFuzz, Nov 23 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6017800060796928 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 7 by ClusterFuzz, Nov 23 2017

ClusterFuzz has detected this issue as fixed in range 518743:518745.

Detailed report: https://clusterfuzz.com/testcase?key=5935291591557120

Fuzzer: bj_broddelwerk
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::ComputeInlineBoxPositionForAtomicInline
  blink::InlineBoxPosition blink::ComputeInlineBoxPositionTemplate<blink::EditingA
  blink::LocalCaretRect blink::LocalCaretRectOfPositionTemplate<blink::EditingAlgo
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=518061:518147
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=518743:518745

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5935291591557120

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment