New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 833447 link

Starred by 3 users

Issue metadata

Status: WontFix
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Null-dereference READ in blink::Node::GetLayoutBoxModelObject

Project Member Reported by ClusterFuzz, Apr 16 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5209145423429632

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  blink::Node::GetLayoutBoxModelObject
  blink::MediaControlSliderElement::TrackWidth
  blink::MediaControlSliderElement::SetBeforeSegmentPosition
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=550802:550806

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5209145423429632

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 16 2018

Labels: OS-Mac
Cc: brajkumar@chromium.org
Components: Blink>Media
Labels: -Type-Bug M-67 Test-Predator-Wrong Type-Bug-Regression
Owner: steimel@chromium.org
Status: Assigned (was: Untriaged)
Predator could not provide any possible suspects.

https://chromium.googlesource.com/chromium/src/+log/38d7bc8297a2985dc0c8aebe31455890baa598f4..0fade57cc302b008312a196c44bd172ae2b70eac?pretty=fuller&n=10000

From the above CL observing some changes related to 'layout tests' , hence suspecting the below 
https://chromium.googlesource.com/chromium/src/+/0fade57cc302b008312a196c44bd172ae2b70eac

steimel@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!
Status: WontFix (was: Assigned)
This is related to my change, but what's happening is that the fuzzer is using internals to change the ids of elements inside the shadow dom, causing us to not find the track element by ID here: https://cs.chromium.org/chromium/src/third_party/blink/renderer/modules/media_controls/elements/media_control_slider_element.cc?l=96

Since this isn't actually something that can happen without using internals, I'm closing this as WontFix. Thanks!
Project Member

Comment 4 by ClusterFuzz, Apr 19 2018

Components: Blink>DOM Blink>Media>Controls
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: steimel@chromium.org
 Issue 834714  has been merged into this issue.
Project Member

Comment 6 by ClusterFuzz, Apr 24 2018

Labels: Needs-Feedback
ClusterFuzz testcase 6739874502410240 is still reproducing on tip-of-tree build (trunk).

If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase.

Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
Labels: -Needs-Feedback ClusterFuzz-Ignore
Project Member

Comment 8 by ClusterFuzz, May 16 2018

ClusterFuzz has detected this issue as fixed in range 558997:559001.

Detailed report: https://clusterfuzz.com/testcase?key=5209145423429632

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  blink::Node::GetLayoutBoxModelObject
  blink::MediaControlSliderElement::TrackWidth
  blink::MediaControlSliderElement::SetBeforeSegmentPosition
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=550802:550806
Fixed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=558997:559001

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5209145423429632

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
 Issue 844241  has been merged into this issue.
 Issue 845068  has been merged into this issue.
Project Member

Comment 11 by ClusterFuzz, Jun 18 2018

Labels: OS-Windows

Sign in to add a comment