Issue metadata
Sign in to add a comment
|
Null-dereference READ in chrome |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5856143147270144 Fuzzer: inferno_webbot Job Type: linux_cfi_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000058 Crash State: chrome blink::LocalFrame::Client blink::LocalFrame::GetContentSettingsClient Sanitizer: cfi (CFI) Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=532297:532302 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5856143147270144 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jan 29 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/aa8ca297c5f87cc3362524bae9f18a8972f80900 (Serialize Text nodes for HTML fragments correctly). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Jan 29 2018
I think this is legit, feel free to revert for now. Also seems a dupe for crbug.com/806681 .
,
Jan 29 2018
Seems like this needs a Frame check, will make a patch.
,
Jan 29 2018
,
Jan 29 2018
,
Jan 30 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/07d632dc072f014f41ba395cccbcebad9a0f4eb1 commit 07d632dc072f014f41ba395cccbcebad9a0f4eb1 Author: Rob Buis <rob.buis@samsung.com> Date: Tue Jan 30 13:09:43 2018 Fix null-dereference caused by r532302 We need to check if there is a frame before calling CanExecuteScripts. Bug: 806681 , 806705 Change-Id: I717cbb92478806b8f2687b099c62558f5abc7f03 Reviewed-on: https://chromium-review.googlesource.com/891304 Reviewed-by: Daniel Cheng <dcheng@chromium.org> Commit-Queue: Rob Buis <rob.buis@samsung.com> Cr-Commit-Position: refs/heads/master@{#532850} [add] https://crrev.com/07d632dc072f014f41ba395cccbcebad9a0f4eb1/third_party/WebKit/LayoutTests/fast/innerHTML/806705-crash.html [modify] https://crrev.com/07d632dc072f014f41ba395cccbcebad9a0f4eb1/third_party/WebKit/Source/core/editing/serializers/MarkupFormatter.cpp
,
Jan 31 2018
ClusterFuzz has detected this issue as fixed in range 532848:532854. Detailed report: https://clusterfuzz.com/testcase?key=5856143147270144 Fuzzer: inferno_webbot Job Type: linux_cfi_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000058 Crash State: chrome blink::LocalFrame::Client blink::LocalFrame::GetContentSettingsClient Sanitizer: cfi (CFI) Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=532297:532302 Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=532848:532854 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5856143147270144 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Jan 29 2018Labels: Test-Predator-Auto-Components