Null-dereference READ in blink::LayoutBoxModelObject::StyleDidChange |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6686617602621440 Fuzzer: inferno_twister Job Type: mac_asan_content_shell Platform Id: mac Crash Type: Null-dereference READ Crash Address: 0x000000000020 Crash State: blink::LayoutBoxModelObject::StyleDidChange blink::LayoutInline::StyleDidChange blink::LayoutObject::SetStyle Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=521659:521676 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6686617602621440 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Dec 8 2017
,
Dec 8 2017
Using the provided regression range assigning to the possible suspect as per the change made for the file, “LayoutInline.cpp” Suspecting Commit# https://chromium.googlesource.com/chromium/src/+/fc5c3629044888b8d723cc11424879bb883d8d3e @futhark -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes. Also, CC'ing kojii@ for the below commit: https://chromium.googlesource.com/chromium/src/+/1a72f714628b594aeee310b22a9174152f481387 Thanks!
,
Dec 8 2017
,
Dec 8 2017
,
Dec 8 2017
,
Dec 11 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/4a7c779ed98e170ce8d51744d59786ad646a80af commit 4a7c779ed98e170ce8d51744d59786ad646a80af Author: Rune Lillesveen <futhark@chromium.org> Date: Mon Dec 11 10:05:04 2017 Add checks for anonymous boxes being of table part. Anonymous inline wrappers for display:contents were mistakenly assumed to be anonymous table parts. Bug: 792439 , 792946 , 792550 Change-Id: Ib7017ff67a8658135d2e08c47f93966d5dbfa5bc Reviewed-on: https://chromium-review.googlesource.com/817564 Commit-Queue: Rune Lillesveen <futhark@chromium.org> Reviewed-by: Morten Stenshorne <mstensho@chromium.org> Cr-Commit-Position: refs/heads/master@{#523069} [modify] https://crrev.com/4a7c779ed98e170ce8d51744d59786ad646a80af/third_party/WebKit/Source/core/layout/LayoutObjectTest.cpp [modify] https://crrev.com/4a7c779ed98e170ce8d51744d59786ad646a80af/third_party/WebKit/Source/core/layout/LayoutTable.cpp [modify] https://crrev.com/4a7c779ed98e170ce8d51744d59786ad646a80af/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
,
Dec 11 2017
,
Dec 12 2017
ClusterFuzz testcase 6686617602621440 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by ClusterFuzz
, Dec 7 2017