ForwardDelete command crashes with mixed editability |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5759823907127296 Fuzzer: ifratric-browserfuzzer-v3 Job Type: linux_cfi_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000020 Crash State: chrome blink::Node::GetDocument blink::HasEditableStyle Sanitizer: cfi (CFI) Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=523197:523221 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5759823907127296 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Dec 13 2017
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/bb33dbbbcf6f36daa5d7d116769b72a3c91ed9dc (Remove ScriptStreamer::resource_). If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
,
Dec 13 2017
My CL looks irrelevant, but didn't find a clear suspect in the range. Bisecting...
,
Dec 15 2017
Bisected on Linux. The first bad commit was: https://chromium-review.googlesource.com/c/chromium/src/+/729040 xiaochengh@, could you take a look?
,
Dec 15 2017
,
Dec 19 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/a0b2c36677205424a9596d92c42998cba5e73b76 commit a0b2c36677205424a9596d92c42998cba5e73b76 Author: Xiaocheng Hu <xiaochengh@chromium.org> Date: Tue Dec 19 00:11:06 2017 Fix a crash where ForwardDelete makes selection invalid There is a case where during ForwardDelete command, we move the selection position disconnected. Continuing to use such selection results in crashes. This patch stops such crashing by adding a selection validity check before the crash site. Bug: 794397 Change-Id: Ifcae203bf146ae974b301ae7f5de40c5661968ad Reviewed-on: https://chromium-review.googlesource.com/828393 Reviewed-by: Ryan Landay <rlanday@chromium.org> Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org> Cr-Commit-Position: refs/heads/master@{#524872} [modify] https://crrev.com/a0b2c36677205424a9596d92c42998cba5e73b76/third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp [modify] https://crrev.com/a0b2c36677205424a9596d92c42998cba5e73b76/third_party/WebKit/Source/core/editing/commands/TypingCommandTest.cpp
,
Dec 19 2017
ClusterFuzz has detected this issue as fixed in range 524868:524894. Detailed report: https://clusterfuzz.com/testcase?key=5759823907127296 Fuzzer: ifratric-browserfuzzer-v3 Job Type: linux_cfi_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000020 Crash State: chrome blink::Node::GetDocument blink::HasEditableStyle Sanitizer: cfi (CFI) Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=523197:523221 Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=524868:524894 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5759823907127296 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Dec 19 2017
ClusterFuzz testcase 5759823907127296 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Dec 13 2017Labels: Test-Predator-Auto-Components