Null-dereference READ in cc::PaintImage::width |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5421471594446848 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x00000000000c Crash State: cc::PaintImage::width cc::DecodedImageTracker::QueueImageDecode cc::LayerTreeHostImpl::QueueImageDecode Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=538992:538995 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5421471594446848 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Apr 4 2018
Unable to find actual suspect through code search and also observing no related changes under regression range, hence adding appropriate label and requesting someone from blink team to look in to this issue. Thanks!
,
Apr 4 2018
,
Apr 6 2018
Khushal, can you take a look at this please?
,
Apr 14 2018
Its crashing the first time we access an image from QueueImageDecode from the main thread. Just needs a null check in LayerTreeHost::QueueImageDecode.
,
Apr 18 2018
ClusterFuzz has detected this issue as fixed in range 551565:551568. Detailed report: https://clusterfuzz.com/testcase?key=5421471594446848 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x00000000000c Crash State: cc::PaintImage::width cc::DecodedImageTracker::QueueImageDecode cc::LayerTreeHostImpl::QueueImageDecode Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=538992:538995 Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:551568 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5421471594446848 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Apr 18 2018
ClusterFuzz testcase 5421471594446848 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Mar 29 2018Labels: Test-Predator-Auto-Components