Issue metadata
Sign in to add a comment
|
Use-of-uninitialized-value in blink::PaintLayerScrollableArea::UpdateScrollOffset |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6754845255270400 Fuzzer: inferno_layout_test_unmodified Job Type: linux_msan_content_shell_drt Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: blink::PaintLayerScrollableArea::UpdateScrollOffset blink::ScrollableArea::ScrollOffsetChanged blink::ProgrammaticScrollAnimator::ScrollToOffsetWithoutAnimation Sanitizer: memory (MSAN) Recommended Security Severity: Medium Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=377255:377290 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6754845255270400 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jan 24 2018
Automatically adding ccs based on suspected regression changelists: Unify memory usage reporters of Oilpan into ThreadState. by peria@chromium.org - https://chromium.googlesource.com/chromium/src/+/62bfa3d4cbdfdfbfd7356e15e34c2aaa0036be74 Ability to return the height of fragmentainer groups that don't yet exist. by mstensho@opera.com - https://chromium.googlesource.com/chromium/src/+/3f96177578cf0511174d42546a70660cc8d6eeeb If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Jan 24 2018
,
Jan 24 2018
,
Jan 24 2018
Looks most likely to be https://chromium.googlesource.com/chromium/src/+/3f96177578cf0511174d42546a70660cc8d6eeeb
,
Jan 24 2018
I find it hard to believe that's the culprit, because the test case doesn't have multicol or any other kind of block fragmentation. Furthermore, I cannot bisect this, because I currently don't have access to a Linux machine, and I won't for the rest of the month either.
,
Jan 26 2018
,
Jan 30 2018
+various people who have touched `PaintLayerScrollableArea::UpdateScrollOffset` over the years. Can someone please take a look? Thanks!
,
Jan 31 2018
No relevant changes in regression range, requesting re-run.
,
Jan 31 2018
This could be related to accessibility, but it could also maybe be a gc issue related to the fact that PaintLayer::scrollable_area_ is a Persistent, which dates back to this CL: https://codereview.chromium.org/1215973002 cc haraken and dmazzoni
,
Jan 31 2018
Each time I request a bisct run it returns completely different ranges, months apart. Without a bisect or repro this isn't really actionable.
,
Feb 4 2018
Could we get some help bisecting this please?
,
Feb 6 2018
ClusterFuzz has detected this issue as fixed in range 534596:534598. Detailed report: https://clusterfuzz.com/testcase?key=6754845255270400 Fuzzer: inferno_layout_test_unmodified Job Type: linux_msan_content_shell_drt Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: blink::PaintLayerScrollableArea::UpdateScrollOffset blink::ScrollableArea::ScrollOffsetChanged blink::ProgrammaticScrollAnimator::ScrollToOffsetWithoutAnimation Sanitizer: memory (MSAN) Recommended Security Severity: Medium Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=430550:430572 Fixed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=534596:534598 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6754845255270400 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Feb 6 2018
ClusterFuzz testcase 6754845255270400 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Feb 7 2018
,
May 23 2018
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Jan 24 2018Labels: Test-Predator-Auto-Components