Issue metadata
Sign in to add a comment
|
Null-dereference READ in blink::DocumentLifecycle::DisallowTransitionScope::DisallowTransitionScope |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5015537156096000 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000200 Crash State: blink::DocumentLifecycle::DisallowTransitionScope::DisallowTransitionScope CreatePlainText<blink::EditingAlgorithm<blink::FlatTreeTraversal> blink::PlainText Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=550102:550107 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5015537156096000 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Apr 19 2018
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
Apr 19 2018
Caused by: <style>* {float:left}</style>
[10784:18668:0419/181256.077:FATAL:text_offset_mapping.cc(155)] Check failed: false. #text "foo"@offsetInAnchor[0]
Minimal HTML to reproduce:
<style>* { float: left; }</style>
<p id="target">foo</p>
<script>
const selection = window.getSelection();
const target = document.getElementById('target');
selection.collapse(target.firstChild, 0);
window.getSelection().modify('extend', 'forward', 'word');
</script>
|
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Apr 19 2018Owner: yosin@chromium.org
Status: Assigned (was: Untriaged)