New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 829758 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in ObtainAndSetContextProvider

Project Member Reported by ClusterFuzz, Apr 6 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4652579603349504

Fuzzer: attekett_dom_fuzzer
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  ObtainAndSetContextProvider
  Invoke<base::OnceCallback<void
  MakeItSo<void
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=548273:548274

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4652579603349504

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 7 2018

Components: Internals>Core Internals>Media
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Apr 7 2018

Labels: Test-Predator-Auto-Owner
Owner: asimjour@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/6bdfed7585104a47ff5aefe81bbc49d4ef5bb8b4 (Support for Autofill in VR).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Cc: a.simjour@chromium.org
Labels: Test-Predator-Wrong-CLs
Owner: ----
Status: Available (was: Assigned)
The changelist that is mentioned here is landed on April 5 (67), and only has effect on Android. The bug is for Linux and is impacting Stable 65.0.3325.181, Beta 66.0.3359.81.
This issue doesn't seems to be related to the particular changelist that is mentioned.
Cc: -a.simjour@chromium.org asimjour@chromium.org
Owner: lethalantidote@chromium.org
Status: Assigned (was: Available)
Project Member

Comment 6 by ClusterFuzz, Apr 14 2018

Labels: M-68 Fuzz-Blocker ReleaseBlock-Beta
This crash occurs very frequently on linux platform and is likely preventing the fuzzer attekett_dom_fuzzer from making much progress. Fixing this will allow more bugs to be found.

Marking this bug as a blocker for next Beta release.

If this is incorrect, please add ClusterFuzz-Wrong label and remove the ReleaseBlock-Beta label.
Labels: -ReleaseBlock-Beta
Hi, this should be caused by a finch experiment, but the last time I checked it was disabled. Looking into it now.
Project Member

Comment 8 by ClusterFuzz, Apr 23 2018

ClusterFuzz has detected this issue as fixed in range 552642:552643.

Detailed report: https://clusterfuzz.com/testcase?key=4652579603349504

Fuzzer: attekett_dom_fuzzer
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  ObtainAndSetContextProvider
  Invoke<base::OnceCallback<void
  MakeItSo<void
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=548273:548274
Fixed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=552642:552643

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4652579603349504

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Apr 23 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4652579603349504 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment