New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 828704 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Chrome
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Null-dereference READ in LocationBarView::ShowPageInfoDialog

Project Member Reported by ClusterFuzz, Apr 4 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5320325718605824

Fuzzer: inferno_twister
Job Type: linux_asan_chrome_media
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  LocationBarView::ShowPageInfoDialog
  IconLabelBubbleView::NotifyClick
  views::Button::OnKeyPressed
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_media&range=547627:547628

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5320325718605824

Additional requirements: Requires Gestures

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 4 2018

Components: Internals>Views UI>Browser>Omnibox
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Apr 4 2018

Labels: Test-Predator-Auto-Owner
Owner: btolsch@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/c4901a12bb32cd65e8c141cf97339a5a604c3dfd (Fix page info dialog for PresentationReceiverWindowController).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 3 by ClusterFuzz, Apr 5 2018

Labels: OS-Chrome
Cc: btolsch@chromium.org ifratric@google.com
 Issue 828805  has been merged into this issue.
Cc: brajkumar@chromium.org
 Issue 829249  has been merged into this issue.

Comment 6 by ajha@chromium.org, Apr 9 2018

Cc: -btolsch@chromium.org ajha@chromium.org
Labels: -Type-Bug ReleaseBlock-Stable RegressedIn-67 FoundIn-67 M-67 Target-67 OS-Windows Type-Bug-Regression
Crashes are seen on Windows as well with magic signature 'LocationBarView::ShowPageInfoDialog'.


Project Member

Comment 7 by sheriffbot@chromium.org, Apr 9 2018

Labels: Fracas
Users experienced this crash on the following builds:

Win Canary 67.0.3390.0 -  0.10 CPM, 10 reports, 6 clients (signature LocationBarView::ShowPageInfoDialog)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas
Project Member

Comment 9 by bugdroid1@chromium.org, Apr 17 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0e6e9217e25ef09cb184c6103ce97554add3e9a1

commit 0e6e9217e25ef09cb184c6103ce97554add3e9a1
Author: btolsch <btolsch@chromium.org>
Date: Tue Apr 17 21:39:48 2018

Check WebContents* in LocationBarView::ShowPageInfoDialog

Bug:  828704 
Change-Id: I1263e0bc2520b7b5f110ac2ae0ac92e3db8e2fd9
Reviewed-on: https://chromium-review.googlesource.com/999310
Reviewed-by: Scott Violet <sky@chromium.org>
Commit-Queue: Brandon Tolsch <btolsch@chromium.org>
Cr-Commit-Position: refs/heads/master@{#551484}
[modify] https://crrev.com/0e6e9217e25ef09cb184c6103ce97554add3e9a1/chrome/browser/ui/views/location_bar/location_icon_view.cc

Comment 10 by ajha@chromium.org, Apr 18 2018

Windows canary version: 67.0.3399.0 has been live for 8 hrs and has not reported any crashes so far.
Project Member

Comment 11 by ClusterFuzz, Apr 19 2018

ClusterFuzz has detected this issue as fixed in range 551478:551482.

Detailed report: https://clusterfuzz.com/testcase?key=5320325718605824

Fuzzer: inferno_twister
Job Type: linux_asan_chrome_media
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  LocationBarView::ShowPageInfoDialog
  IconLabelBubbleView::NotifyClick
  views::Button::OnKeyPressed
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_media&range=547627:547628
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_media&range=551478:551482

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5320325718605824

Additional requirements: Requires Gestures

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by ClusterFuzz, Apr 19 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5320325718605824 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: Merge-TBD
[Auto-generated comment by a script] We noticed that this issue is targeted for M-67; it appears the fix may have landed after branch point, meaning a merge might be required. Please confirm if a merge is required here - if so add Merge-Request-67 label, otherwise remove Merge-TBD label. Thanks.
Cl listed at #9 needs merge to M67. Pls request a merge ASAP.
Labels: -Merge-TBD Merge-Request-67
Adding "Merge-Request-67" label per comment #14.
Project Member

Comment 16 by sheriffbot@chromium.org, Apr 20 2018

Labels: -Merge-Request-67 Merge-Approved-67 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M67. Please go ahead and merge the CL to branch 3396 manually. Please contact milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), kbleicher@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Please merge ASAP so we can pick it up for next M67 Dev/Beta Release. Thank you.
Project Member

Comment 18 by bugdroid1@chromium.org, Apr 20 2018

Labels: -merge-approved-67 merge-merged-3396
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f245cfba9bc4be5144449f8371fcf88a5d370515

commit f245cfba9bc4be5144449f8371fcf88a5d370515
Author: btolsch <btolsch@chromium.org>
Date: Fri Apr 20 19:00:41 2018

Check WebContents* in LocationBarView::ShowPageInfoDialog

TBR=btolsch@chromium.org

(cherry picked from commit 0e6e9217e25ef09cb184c6103ce97554add3e9a1)

Bug:  828704 
Change-Id: I1263e0bc2520b7b5f110ac2ae0ac92e3db8e2fd9
Reviewed-on: https://chromium-review.googlesource.com/999310
Reviewed-by: Scott Violet <sky@chromium.org>
Commit-Queue: Brandon Tolsch <btolsch@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#551484}
Reviewed-on: https://chromium-review.googlesource.com/1022259
Reviewed-by: Brandon Tolsch <btolsch@chromium.org>
Cr-Commit-Position: refs/branch-heads/3396@{#168}
Cr-Branched-From: 9ef2aa869bc7bc0c089e255d698cca6e47d6b038-refs/heads/master@{#550428}
[modify] https://crrev.com/f245cfba9bc4be5144449f8371fcf88a5d370515/chrome/browser/ui/views/location_bar/location_icon_view.cc

Sign in to add a comment