New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 833263 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 832055
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 1
Type: Bug-Regression



Sign in to add a comment

TextOffsetMaaping/ComputeStartPositon(LayoutBlock) crashes with multicol

Project Member Reported by ClusterFuzz, Apr 16 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4846696673312768

Fuzzer: bj_broddelwerk
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: CHECK failure
Crash Address: 
Crash State:
  start <= end (SUB class="CLASS8 CLASS2"class="CLASS5" (editable)@afterAnchor) in
  blink::TextIteratorAlgorithm<blink::EditingAlgorithm<blink::FlatTreeTraversal> >
  blink::TextIteratorAlgorithm<blink::EditingAlgorithm<blink::FlatTreeTraversal> >
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=550079:550107

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4846696673312768

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: brajkumar@chromium.org
Components: Blink>Editing
Labels: -Type-Bug M-67 Test-Predator-Wrong Type-Bug-Regression
Owner: yosin@chromium.org
Status: Assigned (was: Untriaged)
This issue looks similar to  bug 832497 , hence assigning to same dev for more updates on this issue.

yosin@ could you please take a look in to this issue?

Thanks!

Comment 2 by yosin@chromium.org, Apr 17 2018

Mergedinto: 832055
Status: Duplicate (was: Assigned)
Summary: TextOffsetMaaping/ComputeStartPositon(LayoutBlock) crashes with multicol (was: CHECK failure: start <= end (SUB class="CLASS8 CLASS2"class="CLASS5" (editable)@afterAnchor) in)
The root cause is handling of multicol in TextOffsetMapping.

Sign in to add a comment