Issue metadata
Sign in to add a comment
|
Bad-cast to blink::ContextLifecycleObserver from blink::LifecycleObserver<blink::ExecutionContext, blink::ContextLifecycleObserver> in blink::LifecycleObserver<blink::ExecutionContext, blink::ContextLifecycleObserver>::SetContext |
||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5708482012250112 Fuzzer: libFuzzer_renderer_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Bad-cast Crash Address: 0x348297904408 Crash State: Bad-cast to blink::ContextLifecycleObserver from blink::LifecycleObserver<blink::ExecutionContext, blink::ContextLifecycleObserver> blink::LifecycleObserver<blink::ExecutionContext, blink::ContextLifecycleObserver>::SetContext blink::ContextLifecycleObserver::ContextLifecycleObserver Sanitizer: undefined (UBSAN) Recommended Security Severity: High Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=549059:549062 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5708482012250112 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Apr 7 2018
This should be resolved by https://chromium.googlesource.com/chromium/src/+/52611a54cc13c259a6fa79b296a3038d84c0d442
,
Apr 9 2018
This crash occurs very frequently on linux platform and is likely preventing the fuzzer renderer_fuzzer from making much progress. Fixing this will allow more bugs to be found. Marking this bug as a blocker for next Beta release. If this is incorrect, please add ClusterFuzz-Wrong label and remove the ReleaseBlock-Beta label.
,
Apr 10 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/cd81d2e64ffd7f6cace01432abe8b59b978914cd commit cd81d2e64ffd7f6cace01432abe8b59b978914cd Author: Kent Tamura <tkent@chromium.org> Date: Tue Apr 10 04:19:13 2018 Update security_blacklist.txt and vptr_blacklist.txt for the Great Blink mv. LifecycleObserver.h was renamed to lifecycle_observer.h. TBR=thakis@chromium.org Bug: 768828 , 830210 Change-Id: I26008bacc5ebb8446ec0a95e03ad1bd2f34cb102 Reviewed-on: https://chromium-review.googlesource.com/1004076 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Kent Tamura <tkent@chromium.org> Cr-Commit-Position: refs/heads/master@{#549414} [modify] https://crrev.com/cd81d2e64ffd7f6cace01432abe8b59b978914cd/tools/ubsan/security_blacklist.txt [modify] https://crrev.com/cd81d2e64ffd7f6cace01432abe8b59b978914cd/tools/ubsan/vptr_blacklist.txt
,
Apr 10 2018
ClusterFuzz has detected this issue as fixed in range 549412:549415. Detailed report: https://clusterfuzz.com/testcase?key=5708482012250112 Fuzzer: libFuzzer_renderer_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Bad-cast Crash Address: 0x348297904408 Crash State: Bad-cast to blink::ContextLifecycleObserver from blink::LifecycleObserver<blink::ExecutionContext, blink::ContextLifecycleObserver> blink::LifecycleObserver<blink::ExecutionContext, blink::ContextLifecycleObserver>::SetContext blink::ContextLifecycleObserver::ContextLifecycleObserver Sanitizer: undefined (UBSAN) Recommended Security Severity: High Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=549059:549062 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=549412:549415 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5708482012250112 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Apr 10 2018
ClusterFuzz has detected this issue as fixed in range 549412:549415. Detailed report: https://clusterfuzz.com/testcase?key=5708482012250112 Fuzzer: libFuzzer_renderer_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: Bad-cast Crash Address: 0x348297904408 Crash State: Bad-cast to blink::ContextLifecycleObserver from blink::LifecycleObserver<blink::ExecutionContext, blink::ContextLifecycleObserver> blink::LifecycleObserver<blink::ExecutionContext, blink::ContextLifecycleObserver>::SetContext blink::ContextLifecycleObserver::ContextLifecycleObserver Sanitizer: undefined (UBSAN) Recommended Security Severity: High Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=549059:549062 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=549412:549415 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5708482012250112 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Apr 11 2018
,
Jul 15
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by ClusterFuzz
, Apr 7 2018Owner: tkent@chromium.org
Status: Assigned (was: Untriaged)