New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 827878 link

Starred by 1 user
Status: WontFix
Owner:
e...@chromium.org
Closed: Apr 2018
Cc:
vmp...@chromium.org
█ brajkumar@chromium.org
chrishtr@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Stack-overflow in blink::LayoutBox::MinPreferredLogicalWidth

Project Member Reported by ClusterFuzz, Apr 1 2018 
Detailed report: https://clusterfuzz.com/testcase?key=4876758541926400

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7ffc8d7c6fb8
Crash State:
  blink::LayoutBox::MinPreferredLogicalWidth
  blink::LayoutBlock::ComputeBlockPreferredLogicalWidths
  blink::LayoutBlock::ComputeIntrinsicLogicalWidths
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=545879:545880

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4876758541926400

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.

Comment 1 by brajkumar@chromium.org, Apr 2 2018

Cc: brajkumar@chromium.org
Components: Blink>Layout
Labels: -Type-Bug M-67 Test-Predator-Wrong Type-Bug-Regression
Owner: vmp...@chromium.org
Status: Assigned (was: Untriaged)
Predator could not provide any possible suspects.

From the below CL observing only one change is seen which is related to 'layout' , hence suspecting the same
https://chromium.googlesource.com/chromium/src/+log/73cfd3fcb696344b7ecc66519c3a702f0ef6e127..279708b3c8ed5b6d9b4ed452072458cb0f9047d0?pretty=fuller&n=10000

vmpstr@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!

Comment 2 by vmp...@chromium.org, Apr 3 2018

Cc: chrishtr@chromium.org vmp...@chromium.org
Owner: e...@chromium.org
Hmm, the CL in question affects layout tests, but not the layout itself. The testcase seems to crash on chrome stable (for me at least).

-> eae@ for triage.

Comment 3 by e...@chromium.org, Apr 30 2018

Status: WontFix (was: Assigned)
Project Member

Comment 4 by ClusterFuzz, May 7 2018

Labels: Needs-Feedback
ClusterFuzz testcase 4876758541926400 is still reproducing on tip-of-tree build (trunk).

If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase.

Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
►

Sign in to add a comment