Issue metadata
Sign in to add a comment
|
Null-dereference READ in chrome |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4997928176058368 Fuzzer: mbarbella_js_mutation_layout Job Type: linux_cfi_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000008 Crash State: chrome blink::HTMLDocumentParser::EnqueueTokenizedChunk blink::BackgroundHTMLParser::EnqueueTokenizedChunk Sanitizer: cfi (CFI) Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=554303:554322 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4997928176058368 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Apr 28 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/91155378db70515df1dda8c650237a38549b93fa (HTMLDocumentParser: Remove TokenizedChunkQueue). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
May 1 2018
,
May 1 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/9f63db45c1a5bf808e12b2c5a4228b57b9f9f434 commit 9f63db45c1a5bf808e12b2c5a4228b57b9f9f434 Author: Kouhei Ueno <kouhei@chromium.org> Date: Tue May 01 06:58:48 2018 Re-introduce nullchk before calling EnqueueTokenizedChunk This CL reintroduces null check of WeakPtr parser_ which was accidentally removed in 91155378db70515df1dda8c650237a38549b93fa I have manually tested that this fixes the clusterfuzz test cases. To be confirmed via clusterfuzz bots. Bug: 837948, 837893 , 837693 , 689702 Change-Id: I8f149803e24fb949a36fbeee96f17f80a62f6ea0 Reviewed-on: https://chromium-review.googlesource.com/1036885 Reviewed-by: Kentaro Hara <haraken@chromium.org> Commit-Queue: Kouhei Ueno <kouhei@chromium.org> Cr-Commit-Position: refs/heads/master@{#555012} [modify] https://crrev.com/9f63db45c1a5bf808e12b2c5a4228b57b9f9f434/third_party/blink/renderer/core/html/parser/background_html_parser.cc
,
May 2 2018
ClusterFuzz has detected this issue as fixed in range 555003:555014. Detailed report: https://clusterfuzz.com/testcase?key=4997928176058368 Fuzzer: mbarbella_js_mutation_layout Job Type: linux_cfi_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000008 Crash State: chrome blink::HTMLDocumentParser::EnqueueTokenizedChunk blink::BackgroundHTMLParser::EnqueueTokenizedChunk Sanitizer: cfi (CFI) Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=554303:554322 Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=555003:555014 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4997928176058368 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Apr 28 2018Labels: Test-Predator-Auto-Components