CHECK failure: frame->GetDocument()->LoadEventFinished() in SVGImage.cpp |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4860886899752960 Fuzzer: attekett_dom_fuzzer Job Type: linux_asan_chrome_media Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: frame->GetDocument()->LoadEventFinished() in SVGImage.cpp blink::SVGImage::CheckLoaded blink::SVGImage::CurrentFrameHasSingleSecurityOrigin Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_media&range=519616:519636 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4860886899752960 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Nov 28 2017
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
Nov 28 2017
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/13e639e3d29507db1977ac39ce43f224fcb82a79 (Loading SVG with 0x0 instrinsic dimension should dispatch load event.). If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
,
Nov 29 2017
,
Nov 30 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/41f11ee546ee82fbef71d2161ac3f02ee49c7acb commit 41f11ee546ee82fbef71d2161ac3f02ee49c7acb Author: Shanmuga Pandi M <shanmuga.m@samsung.com> Date: Thu Nov 30 14:00:09 2017 Asynchronous loading SVG should not crash This patch fixes the following * Loading asynchronous SVG image with parse error should not crash. * Loading zero intrinsic SVG image with reference data:uri image should not dispatch 'error' event Bug: 789291 , 789228 , 789518 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2 Change-Id: Ic9137507ca43a93dd30c492a0d20698a89bb945e Reviewed-on: https://chromium-review.googlesource.com/796231 Reviewed-by: Fredrik Söderquist <fs@opera.com> Commit-Queue: Shanmuga Pandi <shanmuga.m@samsung.com> Cr-Commit-Position: refs/heads/master@{#520531} [add] https://crrev.com/41f11ee546ee82fbef71d2161ac3f02ee49c7acb/third_party/WebKit/LayoutTests/svg/as-image/invalid-svg-image-with-data-uri.html [add] https://crrev.com/41f11ee546ee82fbef71d2161ac3f02ee49c7acb/third_party/WebKit/LayoutTests/svg/as-image/resources/invalid-image-with-data-uri.svg [add] https://crrev.com/41f11ee546ee82fbef71d2161ac3f02ee49c7acb/third_party/WebKit/LayoutTests/svg/as-image/resources/zero-size-image-with-data-uri.svg [add] https://crrev.com/41f11ee546ee82fbef71d2161ac3f02ee49c7acb/third_party/WebKit/LayoutTests/svg/as-image/svg-with-parse-error-crash-expected.txt [add] https://crrev.com/41f11ee546ee82fbef71d2161ac3f02ee49c7acb/third_party/WebKit/LayoutTests/svg/as-image/svg-with-parse-error-crash.html [add] https://crrev.com/41f11ee546ee82fbef71d2161ac3f02ee49c7acb/third_party/WebKit/LayoutTests/svg/as-image/zero-size-svg-image-with-data-uri.html [modify] https://crrev.com/41f11ee546ee82fbef71d2161ac3f02ee49c7acb/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp
,
Nov 30 2017
,
Dec 1 2017
ClusterFuzz has detected this issue as fixed in range 520517:520531. Detailed report: https://clusterfuzz.com/testcase?key=4860886899752960 Fuzzer: attekett_dom_fuzzer Job Type: linux_asan_chrome_media Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: frame->GetDocument()->LoadEventFinished() in SVGImage.cpp blink::SVGImage::CheckLoaded blink::SVGImage::CurrentFrameHasSingleSecurityOrigin Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_media&range=519616:519636 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_media&range=520517:520531 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4860886899752960 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Dec 1 2017
ClusterFuzz testcase 4860886899752960 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, Nov 28 2017