New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 839961 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Out until 24 Jan
Closed: May 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 2
Type: Bug-Security

Blocking:
issue 838161



Sign in to add a comment

Heap-use-after-free in test_runner::PrintFrameDescription

Project Member Reported by ClusterFuzz, May 4 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6678799295709184

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x61100005f2e8
Crash State:
  test_runner::PrintFrameDescription
  test_runner::WebFrameTestClient::DidFailLoad
  test_runner::WebFrameTestProxy<content::RenderFrameImpl, content::RenderFrameImp
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=555986:555993

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6678799295709184

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 4 2018

Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, May 4 2018

Labels: Test-Predator-Auto-Owner
Owner: fsam...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/664698a679a27ce4e752c5c5e5092eb4a32c3866 (Surface synchronization: Simplify resize throttling).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Labels: Test-Predator-Wrong-CLs
Owner: ----
Status: Untriaged (was: Assigned)
The change I made shouldn't affect this call stack at all.
Owner: nasko@chromium.org
Status: Assigned (was: Untriaged)
Guessing 
https://chromium.googlesource.com/chromium/src/+/d83b571dc700010f144b68fe3d8628923c008773 based on regression range.  Nasko, feel free to bounce back if I'm wrong.  Thanks

Comment 5 by nasko@chromium.org, May 4 2018

Cc: rbpotter@chromium.org
Adding rbpotter@ too, since there are two CLs in the range that include print preview work.
Most of the changes in those CLs are adding browser tests for the new Print Preview UI. The few other changes are to code for the componentized UI that is behind a flag that is turned off by default, and I don't see any indication in the report that cluster fuzz turned it on. I also am not sure how print preview changes would cause that stack trace.
The relevant code in content/shell/test_runner/web_frame_test_client.cc has nothing to do with printing.

Comment 8 by nasko@chromium.org, May 5 2018

Labels: -Security_Severity-High Security_Severity-Low Pri-2
I think I have an idea why it might be due to my CL, as I got a different report from ClusterFuzz about hitting a CHECK through test code that I fully understand. I'll poke a this next week, but lowering priority and severity as this is likely just test code. 
Labels: M-68
Project Member

Comment 10 by ClusterFuzz, May 10 2018

ClusterFuzz has detected this issue as fixed in range 557187:557205.

Detailed report: https://clusterfuzz.com/testcase?key=6678799295709184

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x61100005f2e8
Crash State:
  test_runner::PrintFrameDescription
  test_runner::WebFrameTestClient::DidFailLoad
  test_runner::WebFrameTestProxy<content::RenderFrameImpl, content::RenderFrameImp
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=555986:555993
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=557187:557205

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6678799295709184

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, May 10 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6678799295709184 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 12 by sheriffbot@chromium.org, May 10 2018

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify

Comment 13 by nasko@chromium.org, May 11 2018

Blocking: 838161
Components: Internals>Sandbox>SiteIsolation
Project Member

Comment 15 by sheriffbot@chromium.org, Aug 16

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment