New issue
Advanced search Search tips

Issue 805401 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 808767
Owner:
Closed: Feb 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 1
Type: Bug-Security



Sign in to add a comment

Use-of-uninitialized-value in blink::PaintLayerScrollableArea::UpdateScrollOffset

Project Member Reported by ClusterFuzz, Jan 24 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6754845255270400

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  blink::PaintLayerScrollableArea::UpdateScrollOffset
  blink::ScrollableArea::ScrollOffsetChanged
  blink::ProgrammaticScrollAnimator::ScrollToOffsetWithoutAnimation
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=377255:377290

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6754845255270400

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jan 24 2018

Components: Blink>Paint Platform
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jan 24 2018

Cc: msten...@opera.com peria@chromium.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Unify memory usage reporters of Oilpan into ThreadState. by peria@chromium.org - https://chromium.googlesource.com/chromium/src/+/62bfa3d4cbdfdfbfd7356e15e34c2aaa0036be74

Ability to return the height of fragmentainer groups that don't yet exist. by mstensho@opera.com - https://chromium.googlesource.com/chromium/src/+/3f96177578cf0511174d42546a70660cc8d6eeeb

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 3 by sheriffbot@chromium.org, Jan 24 2018

Labels: M-64
Project Member

Comment 4 by sheriffbot@chromium.org, Jan 24 2018

Labels: Pri-1
Cc: -msten...@opera.com mstensho@chromium.org
Components: -Blink>Paint -Platform Blink>Layout>MultiCol
Owner: mstensho@chromium.org
Status: Assigned (was: Untriaged)
Looks most likely to be https://chromium.googlesource.com/chromium/src/+/3f96177578cf0511174d42546a70660cc8d6eeeb
Owner: ----
Status: Untriaged (was: Assigned)
I find it hard to believe that's the culprit, because the test case doesn't have multicol or any other kind of block fragmentation. Furthermore, I cannot bisect this, because I currently don't have access to a Linux machine, and I won't for the rest of the month either.

Comment 7 by e...@chromium.org, Jan 26 2018

Labels: Needs-Bisect

Comment 8 by palmer@chromium.org, Jan 30 2018

Cc: skobes@chromium.org szager@chromium.org dsinclair@chromium.org zhuoyu.q...@samsung.com lukasza@chromium.org
Labels: OS-Android OS-Chrome OS-Fuchsia OS-Mac OS-Windows
+various people who have touched `PaintLayerScrollableArea::UpdateScrollOffset` over the years. Can someone please take a look? Thanks!

Comment 9 by e...@chromium.org, Jan 31 2018

No relevant changes in regression range, requesting re-run.
Cc: haraken@chromium.org dmazz...@chromium.org
This could be related to accessibility, but it could also maybe be a gc issue related to the fact that PaintLayer::scrollable_area_ is a Persistent, which dates back to this CL:

https://codereview.chromium.org/1215973002

cc haraken and dmazzoni

Comment 11 by e...@chromium.org, Jan 31 2018

Labels: -Reproducible -Test-Predator-Auto-Components Test-Predator-Wrong
Each time I request a bisct run it returns completely different ranges, months apart. Without a bisect or repro this isn't really actionable.

Comment 12 by e...@chromium.org, Feb 4 2018

Owner: palmer@chromium.org
Status: Assigned (was: Untriaged)
Could we get some help bisecting this please? 
Project Member

Comment 13 by ClusterFuzz, Feb 6 2018

ClusterFuzz has detected this issue as fixed in range 534596:534598.

Detailed report: https://clusterfuzz.com/testcase?key=6754845255270400

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  blink::PaintLayerScrollableArea::UpdateScrollOffset
  blink::ScrollableArea::ScrollOffsetChanged
  blink::ProgrammaticScrollAnimator::ScrollToOffsetWithoutAnimation
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=430550:430572
Fixed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=534596:534598

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6754845255270400

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 14 by ClusterFuzz, Feb 6 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6754845255270400 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Mergedinto: 808767
Status: Duplicate (was: Verified)
Project Member

Comment 16 by sheriffbot@chromium.org, May 23 2018

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment