New issue
Advanced search Search tips

Issue 794397 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

ForwardDelete command crashes with mixed editability

Project Member Reported by ClusterFuzz, Dec 13 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5759823907127296

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000020
Crash State:
  chrome
  blink::Node::GetDocument
  blink::HasEditableStyle
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=523197:523221

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5759823907127296

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Dec 13 2017

Components: Blink>DOM Blink>Editing
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Dec 13 2017

Labels: Test-Predator-Auto-Owner
Owner: hirosh...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/bb33dbbbcf6f36daa5d7d116769b72a3c91ed9dc (Remove ScriptStreamer::resource_).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
My CL looks irrelevant, but didn't find a clear suspect in the range. Bisecting...
Cc: hirosh...@chromium.org
Owner: xiaoche...@chromium.org
Bisected on Linux.

The first bad commit was:
https://chromium-review.googlesource.com/c/chromium/src/+/729040

xiaochengh@, could you take a look?

Comment 5 Deleted

Summary: ForwardDelete command crashes with mixed editability (was: Null-dereference READ in chrome)
Project Member

Comment 7 by bugdroid1@chromium.org, Dec 19 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a0b2c36677205424a9596d92c42998cba5e73b76

commit a0b2c36677205424a9596d92c42998cba5e73b76
Author: Xiaocheng Hu <xiaochengh@chromium.org>
Date: Tue Dec 19 00:11:06 2017

Fix a crash where ForwardDelete makes selection invalid

There is a case where during ForwardDelete command, we move the
selection position disconnected. Continuing to use such selection
results in crashes. This patch stops such crashing by adding a
selection validity check before the crash site.

Bug:  794397 
Change-Id: Ifcae203bf146ae974b301ae7f5de40c5661968ad
Reviewed-on: https://chromium-review.googlesource.com/828393
Reviewed-by: Ryan Landay <rlanday@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#524872}
[modify] https://crrev.com/a0b2c36677205424a9596d92c42998cba5e73b76/third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp
[modify] https://crrev.com/a0b2c36677205424a9596d92c42998cba5e73b76/third_party/WebKit/Source/core/editing/commands/TypingCommandTest.cpp

Project Member

Comment 8 by ClusterFuzz, Dec 19 2017

ClusterFuzz has detected this issue as fixed in range 524868:524894.

Detailed report: https://clusterfuzz.com/testcase?key=5759823907127296

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000020
Crash State:
  chrome
  blink::Node::GetDocument
  blink::HasEditableStyle
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=523197:523221
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=524868:524894

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5759823907127296

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Dec 19 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5759823907127296 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment