New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 803520 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Not working on Chrome any more
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::CSSValue::CssText

Project Member Reported by ClusterFuzz, Jan 18 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4846506258726912

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::CSSValue::CssText
  blink::AtRuleCSSStyleDeclaration::getPropertyValue
  blink::V8CSSStyleDeclaration::getPropertyValueMethodCallback
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=530081:530082

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4846506258726912

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jan 18 2018

Labels: OS-Mac
Project Member

Comment 2 by ClusterFuzz, Jan 18 2018

Components: Blink>CSS
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 3 by ClusterFuzz, Jan 18 2018

Labels: Test-Predator-Auto-Owner
Owner: meade@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/4e4f284da26ddd29261853bad70a67848bb00539 (Replace CSSPropertyValueSet in @font-face related objects with a new AtRuleDescriptorValueSet.).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 4 by bugdroid1@chromium.org, Jan 19 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/32c5f6b31c49bb0673bdc0cb0e464765d6ca82a1

commit 32c5f6b31c49bb0673bdc0cb0e464765d6ca82a1
Author: Eddy Mead <meade@chromium.org>
Date: Fri Jan 19 06:17:38 2018

Fix segfault in AtRuleCSSStyleDeclaration::getPropertyValue

Bug:  803453 ,  803520 
Change-Id: I3870ea56cd8349704621f3a72b64b69a24624680
Reviewed-on: https://chromium-review.googlesource.com/874981
Reviewed-by: nainar <nainar@chromium.org>
Commit-Queue: meade_UTC10 <meade@chromium.org>
Cr-Commit-Position: refs/heads/master@{#530434}
[add] https://crrev.com/32c5f6b31c49bb0673bdc0cb0e464765d6ca82a1/third_party/WebKit/LayoutTests/fast/css/invalid-font-face-crash.html
[modify] https://crrev.com/32c5f6b31c49bb0673bdc0cb0e464765d6ca82a1/third_party/WebKit/Source/core/css/AtRuleCSSStyleDeclaration.cpp

Project Member

Comment 5 by ClusterFuzz, Jan 19 2018

Labels: OS-Windows
Project Member

Comment 6 by ClusterFuzz, Jan 19 2018

ClusterFuzz has detected this issue as fixed in range 530433:530434.

Detailed report: https://clusterfuzz.com/testcase?key=4846506258726912

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::CSSValue::CssText
  blink::AtRuleCSSStyleDeclaration::getPropertyValue
  blink::V8CSSStyleDeclaration::getPropertyValueMethodCallback
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=530081:530082
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=530433:530434

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4846506258726912

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Jan 19 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4846506258726912 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: Merge-Request-65
This seems to cause a reproducible crash in play books. requesting a merge to 65.
Labels: -Merge-Request-65
Removing the merge request because it looks like there's a different plan for addressing the crash in 65.
Labels: Merge-Request-65
Re-adding the merge request because this is the smallest fix and the time window is short for the next build.
Labels: OS-Android
Labels: -Merge-Request-65 Merge-Approved-65
Project Member

Comment 13 by bugdroid1@chromium.org, Jan 31 2018

Labels: -merge-approved-65 merge-merged-3325
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ac9784815d5a33201bbeb248612c5ee4f0ec171b

commit ac9784815d5a33201bbeb248612c5ee4f0ec171b
Author: Tobias Sargeant <tobiasjs@google.com>
Date: Wed Jan 31 17:46:04 2018

Fix segfault in AtRuleCSSStyleDeclaration::getPropertyValue

TBR=meade@chromium.org

(cherry picked from commit 32c5f6b31c49bb0673bdc0cb0e464765d6ca82a1)

Bug:  803453 ,  803520 
Change-Id: I3870ea56cd8349704621f3a72b64b69a24624680
Reviewed-on: https://chromium-review.googlesource.com/874981
Reviewed-by: nainar <nainar@chromium.org>
Commit-Queue: meade_UTC10 <meade@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#530434}
Reviewed-on: https://chromium-review.googlesource.com/895458
Reviewed-by: Tobias Sargeant <tobiasjs@chromium.org>
Cr-Commit-Position: refs/branch-heads/3325@{#201}
Cr-Branched-From: bc084a8b5afa3744a74927344e304c02ae54189f-refs/heads/master@{#530369}
[add] https://crrev.com/ac9784815d5a33201bbeb248612c5ee4f0ec171b/third_party/WebKit/LayoutTests/fast/css/invalid-font-face-crash.html
[modify] https://crrev.com/ac9784815d5a33201bbeb248612c5ee4f0ec171b/third_party/WebKit/Source/core/css/AtRuleCSSStyleDeclaration.cpp

Sign in to add a comment