New issue
Advanced search Search tips

Issue 788268 link

Starred by 1 user

Issue metadata

Status: Verified
Owner: ----
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

Null-dereference READ in GetFlag

Project Member Reported by ClusterFuzz, Nov 24 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5320345052774400

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  GetFlag
  IsDocumentFragment
  blink::Node::ContainsIncludingHostElements
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=483676:483690

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5320345052774400

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 24 2017

Components: Blink>DOM
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: kkaluri@chromium.org
Labels: M-63
Owner: hayato@chromium.org
Status: Assigned (was: Untriaged)
Predator provided 1 one possible suspect 
* Implement lazy (re-)attachment of whitespace. by rune@opera.com

rune@ is not present in the owners list, hence assigning it to the reviewer 

hayato@ -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.


Comment 3 by hayato@chromium.org, Nov 27 2017

Cc: hayato@chromium.org
Components: -Blink>DOM Blink>Layout
Owner: futhark@chromium.org
rune@, could you take a look?

BTW, we might want to move WhiteSpaceAttacher to somewhere other than Source/core/dom directory.
Cc: futhark@chromium.org
Components: -Blink>Layout Blink>Editing
Owner: ----
Status: Available (was: Assigned)
This is most likely a bug in the editing code. There are a bunch of DCHECKs triggering in that area before the crash. If my CL made the fuzzer case start crashing, it's probably because it revealed an existing bug.

Comment 5 by yosin@chromium.org, Dec 6 2017

Labels: Pri-3
Lower to Pri-3 since this is caused by unusual HTML.
Project Member

Comment 6 by ClusterFuzz, Dec 14 2017

Cc: r...@opera.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Implement lazy (re-)attachment of whitespace. by rune@opera.com - https://chromium.googlesource.com/chromium/src/+/7c44da721a59e6aa0b9fdcddb314175cb1e0123f

If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Cc: -r...@opera.com
Project Member

Comment 8 by ClusterFuzz, Jan 13 2018

ClusterFuzz has detected this issue as fixed in range 528919:528920.

Detailed report: https://clusterfuzz.com/testcase?key=5320345052774400

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  GetFlag
  IsDocumentFragment
  blink::Node::ContainsIncludingHostElements
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=483676:483690
Fixed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=528919:528920

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5320345052774400

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Jan 13 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 5320345052774400 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment