Null-dereference READ in blink::CSSValue::CssText |
|||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4846506258726912 Fuzzer: inferno_layout_test_unmodified Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::CSSValue::CssText blink::AtRuleCSSStyleDeclaration::getPropertyValue blink::V8CSSStyleDeclaration::getPropertyValueMethodCallback Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=530081:530082 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4846506258726912 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jan 18 2018
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
Jan 18 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/4e4f284da26ddd29261853bad70a67848bb00539 (Replace CSSPropertyValueSet in @font-face related objects with a new AtRuleDescriptorValueSet.). If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
,
Jan 19 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/32c5f6b31c49bb0673bdc0cb0e464765d6ca82a1 commit 32c5f6b31c49bb0673bdc0cb0e464765d6ca82a1 Author: Eddy Mead <meade@chromium.org> Date: Fri Jan 19 06:17:38 2018 Fix segfault in AtRuleCSSStyleDeclaration::getPropertyValue Bug: 803453 , 803520 Change-Id: I3870ea56cd8349704621f3a72b64b69a24624680 Reviewed-on: https://chromium-review.googlesource.com/874981 Reviewed-by: nainar <nainar@chromium.org> Commit-Queue: meade_UTC10 <meade@chromium.org> Cr-Commit-Position: refs/heads/master@{#530434} [add] https://crrev.com/32c5f6b31c49bb0673bdc0cb0e464765d6ca82a1/third_party/WebKit/LayoutTests/fast/css/invalid-font-face-crash.html [modify] https://crrev.com/32c5f6b31c49bb0673bdc0cb0e464765d6ca82a1/third_party/WebKit/Source/core/css/AtRuleCSSStyleDeclaration.cpp
,
Jan 19 2018
,
Jan 19 2018
ClusterFuzz has detected this issue as fixed in range 530433:530434. Detailed report: https://clusterfuzz.com/testcase?key=4846506258726912 Fuzzer: inferno_layout_test_unmodified Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::CSSValue::CssText blink::AtRuleCSSStyleDeclaration::getPropertyValue blink::V8CSSStyleDeclaration::getPropertyValueMethodCallback Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=530081:530082 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=530433:530434 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4846506258726912 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jan 19 2018
ClusterFuzz testcase 4846506258726912 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jan 31 2018
This seems to cause a reproducible crash in play books. requesting a merge to 65.
,
Jan 31 2018
Removing the merge request because it looks like there's a different plan for addressing the crash in 65.
,
Jan 31 2018
Re-adding the merge request because this is the smallest fix and the time window is short for the next build.
,
Jan 31 2018
,
Jan 31 2018
,
Jan 31 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/ac9784815d5a33201bbeb248612c5ee4f0ec171b commit ac9784815d5a33201bbeb248612c5ee4f0ec171b Author: Tobias Sargeant <tobiasjs@google.com> Date: Wed Jan 31 17:46:04 2018 Fix segfault in AtRuleCSSStyleDeclaration::getPropertyValue TBR=meade@chromium.org (cherry picked from commit 32c5f6b31c49bb0673bdc0cb0e464765d6ca82a1) Bug: 803453 , 803520 Change-Id: I3870ea56cd8349704621f3a72b64b69a24624680 Reviewed-on: https://chromium-review.googlesource.com/874981 Reviewed-by: nainar <nainar@chromium.org> Commit-Queue: meade_UTC10 <meade@chromium.org> Cr-Original-Commit-Position: refs/heads/master@{#530434} Reviewed-on: https://chromium-review.googlesource.com/895458 Reviewed-by: Tobias Sargeant <tobiasjs@chromium.org> Cr-Commit-Position: refs/branch-heads/3325@{#201} Cr-Branched-From: bc084a8b5afa3744a74927344e304c02ae54189f-refs/heads/master@{#530369} [add] https://crrev.com/ac9784815d5a33201bbeb248612c5ee4f0ec171b/third_party/WebKit/LayoutTests/fast/css/invalid-font-face-crash.html [modify] https://crrev.com/ac9784815d5a33201bbeb248612c5ee4f0ec171b/third_party/WebKit/Source/core/css/AtRuleCSSStyleDeclaration.cpp |
|||||||||||
►
Sign in to add a comment |
|||||||||||
Comment 1 by ClusterFuzz
, Jan 18 2018