Null-dereference READ in SkImage::isTextureBacked |
||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4964127218073600 Fuzzer: inferno_layout_test_fuzzer Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: SkImage::isTextureBacked blink::StaticBitmapImage::Create blink::ScaleImage Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=497926:497981 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4964127218073600 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Dec 12 2017
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/ea842652ade759fd60cc607889df9facb4cd768f (Revert "Use swap time for first meaningful paint candidates"). If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
,
Dec 12 2017
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
Dec 13 2017
I was just the sheriff who reverted the CL. Randomly assigning to one of the owners from https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/paint/OWNERS.
,
Dec 13 2017
I'll look into it. Thanks for re-assigning to the team.
,
Jan 23 2018
,
Jan 23 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/09de059a05b979f96e4c4b436fe6e51e52f0834b commit 09de059a05b979f96e4c4b436fe6e51e52f0834b Author: Stephen Chenney <schenney@chromium.org> Date: Tue Jan 23 15:25:53 2018 Check for null image in ImageBitmap's ScaleImage Skia will return null on an attempt to create a zero size image, and probably some other cases. Catch this before asking for information from the image. R=ccameron@chromium.org, xidachen@chromium.org BUG= 794355 Change-Id: I61676adf491bb32bed49530b4e69d4da962c2d75 Reviewed-on: https://chromium-review.googlesource.com/881282 Reviewed-by: Xida Chen <xidachen@chromium.org> Commit-Queue: Stephen Chenney <schenney@chromium.org> Cr-Commit-Position: refs/heads/master@{#531239} [add] https://crrev.com/09de059a05b979f96e4c4b436fe6e51e52f0834b/third_party/WebKit/LayoutTests/fast/canvas-api/canvas-createimagebitmap-resize-to-zero.html [modify] https://crrev.com/09de059a05b979f96e4c4b436fe6e51e52f0834b/third_party/WebKit/Source/core/imagebitmap/ImageBitmap.cpp
,
Jan 23 2018
,
Jan 24 2018
ClusterFuzz has detected this issue as fixed in range 531238:531239. Detailed report: https://clusterfuzz.com/testcase?key=4964127218073600 Fuzzer: inferno_layout_test_fuzzer Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: SkImage::isTextureBacked blink::StaticBitmapImage::Create blink::ScaleImage Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=497926:497981 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=531238:531239 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4964127218073600 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jan 24 2018
ClusterFuzz testcase 4964127218073600 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by ClusterFuzz
, Dec 12 2017