New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 812962 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Feb 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::PaintLayerScrollableArea::GetSmoothScrollSequencer

Project Member Reported by ClusterFuzz, Feb 16 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4809443410444288

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  blink::PaintLayerScrollableArea::GetSmoothScrollSequencer
  blink::ProgrammaticScrollAnimator::ScrollToOffsetWithoutAnimation
  blink::ScrollableArea::SetScrollOffset
  
Sanitizer: memory (MSAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4809443410444288

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: chrishtr@chromium.org brajkumar@chromium.org
Components: Blink>Paint
Labels: M-65 Test-Predator-Wrong CF-NeedsTriage
Unable to find the suspect through code search and also from the provided CL, hence adding appropriate label and leaving it as untriaged for further updates.

Thanks!

Project Member

Comment 2 by ClusterFuzz, Feb 16 2018

Labels: OS-Mac
Owner: flackr@chromium.org
Status: Assigned (was: Untriaged)
This is another one of the accessibilkity removes element while scrolling bugs. Did a fix get landed for this? I seem to recall it did.

Comment 4 by flackr@chromium.org, Feb 16 2018

Status: Started (was: Assigned)
https://chromium-review.googlesource.com/c/chromium/src/+/922685 should fix it, but the bots are being slow.

Comment 5 by flackr@chromium.org, Feb 16 2018

The patch was just merged, I'll check whether that fixes this test case too.
Project Member

Comment 6 by ClusterFuzz, Feb 17 2018

ClusterFuzz has detected this issue as fixed in range 537316:537317.

Detailed report: https://clusterfuzz.com/testcase?key=4809443410444288

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  blink::PaintLayerScrollableArea::GetSmoothScrollSequencer
  blink::ProgrammaticScrollAnimator::ScrollToOffsetWithoutAnimation
  blink::ScrollableArea::SetScrollOffset
  
Sanitizer: memory (MSAN)

Fixed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=537316:537317

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4809443410444288

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Feb 17 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 4809443410444288 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment