Null-dereference READ in blink::ContainerNode::EnsurePreInsertionValidity |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6245092213129216 Fuzzer: ifratric-browserfuzzer-v3 Job Type: mac_asan_chrome Platform Id: mac Crash Type: Null-dereference READ Crash Address: 0x000000000010 Crash State: blink::ContainerNode::EnsurePreInsertionValidity blink::ContainerNode::InsertBefore blink::ContainerNode::InsertBefore Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=521257:521271 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6245092213129216 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Dec 7 2017
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/27fc5a3a1f3f1bdfa1e23602260c3d206b9ea79f (Remove AlwaysCreateUserAgentShadowRoot). If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
,
Dec 28 2017
,
Jan 5 2018
Null-ptr deref, and technically it should reproduce on all Blink platforms.
,
Jan 5 2018
Actually this is a regression.
,
Jan 5 2018
Reverting the CL pointed out by comment#2. With the change, the following HTML can create V0 shadow root on <input> before its UA shadow root is attached. ```html <input id="input_element" type="radio"> <script> var root = input_element.createShadowRoot(); input_element.type = "text/vbs"; </script> ``` Revert CL: https://chromium-review.googlesource.com/c/chromium/src/+/851852
,
Jan 6 2018
ClusterFuzz has detected this issue as fixed in range 527241:527247. Detailed report: https://clusterfuzz.com/testcase?key=6245092213129216 Fuzzer: ifratric-browserfuzzer-v3 Job Type: mac_asan_chrome Platform Id: mac Crash Type: Null-dereference READ Crash Address: 0x000000000010 Crash State: blink::ContainerNode::EnsurePreInsertionValidity blink::ContainerNode::InsertBefore blink::ContainerNode::InsertBefore Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=521257:521271 Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=527241:527247 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6245092213129216 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jan 6 2018
ClusterFuzz testcase 6245092213129216 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, Dec 7 2017Labels: Test-Predator-Auto-Components