Null-dereference READ in blink::ComputeInlineBoxPositionForAtomicInline |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5935291591557120 Fuzzer: bj_broddelwerk Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::ComputeInlineBoxPositionForAtomicInline blink::InlineBoxPosition blink::ComputeInlineBoxPositionTemplate<blink::EditingA blink::LocalCaretRect blink::LocalCaretRectOfPositionTemplate<blink::EditingAlgo Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=518061:518147 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5935291591557120 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Nov 22 2017
Automatically adding ccs based on suspected regression changelists: Revert "Get rid of redundant call of SetIsDirectional() in SelectionController::SetNonDirectionalSelectionIfNeeded()" by xiaochengh@chromium.org - https://chromium.googlesource.com/chromium/src/+/217d5aa0eba9d6e74f54712b1c1c5197442d5738 Final preparation for adding DCHECK(CanUseInlineBox) in ComputeInlineBoxPosition() by xiaochengh@chromium.org - https://chromium.googlesource.com/chromium/src/+/12aa0c6679bd58808cd87106e2bd41cba9912858 If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
,
Nov 22 2017
Whoops. I made a wrong assumption when refactoring this function.
,
Nov 22 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/1f1cab54da2c7eca322543b7f61710fc5f1e3b15 commit 1f1cab54da2c7eca322543b7f61710fc5f1e3b15 Author: Xiaocheng Hu <xiaochengh@chromium.org> Date: Wed Nov 22 21:08:09 2017 Revert "Final preparation for adding DCHECK(CanUseInlineBox) in ComputeInlineBoxPosition()" This reverts commit 12aa0c6679bd58808cd87106e2bd41cba9912858. Reason for revert: causing crbug.com/787764 Original change's description: > Final preparation for adding DCHECK(CanUseInlineBox) in ComputeInlineBoxPosition() > > This patch further refactors ComputeInlineBoxPositionForAtomicInline(), > so that it is now straightforward to add DCHECK(CanUseInlineBox) into > the code to trach usage of legacy inline boxes. > > Bug: 771398 > Change-Id: I3a3e839ebbc489cd2fa251259fe94921bf25de15 > Reviewed-on: https://chromium-review.googlesource.com/780365 > Reviewed-by: Yoshifumi Inoue <yosin@chromium.org> > Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org> > Cr-Commit-Position: refs/heads/master@{#518123} TBR=yosin@chromium.org,yoichio@chromium.org,kojii@chromium.org,xiaochengh@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: 771398, 787764 Change-Id: I86b044132e4ed5472641e9e3674bdae71a9455e5 Reviewed-on: https://chromium-review.googlesource.com/786451 Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org> Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org> Cr-Commit-Position: refs/heads/master@{#518744} [modify] https://crrev.com/1f1cab54da2c7eca322543b7f61710fc5f1e3b15/third_party/WebKit/Source/core/editing/InlineBoxPosition.cpp
,
Nov 23 2017
,
Nov 23 2017
ClusterFuzz testcase 6017800060796928 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Nov 23 2017
ClusterFuzz has detected this issue as fixed in range 518743:518745. Detailed report: https://clusterfuzz.com/testcase?key=5935291591557120 Fuzzer: bj_broddelwerk Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::ComputeInlineBoxPositionForAtomicInline blink::InlineBoxPosition blink::ComputeInlineBoxPositionTemplate<blink::EditingA blink::LocalCaretRect blink::LocalCaretRectOfPositionTemplate<blink::EditingAlgo Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=518061:518147 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=518743:518745 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5935291591557120 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Nov 22 2017Labels: Test-Predator-Auto-Components