Issue metadata
Sign in to add a comment
|
Heap-use-after-free in test_runner::PrintFrameDescription |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6678799295709184 Fuzzer: inferno_layout_test_unmodified Job Type: mac_asan_content_shell Platform Id: mac Crash Type: Heap-use-after-free READ 8 Crash Address: 0x61100005f2e8 Crash State: test_runner::PrintFrameDescription test_runner::WebFrameTestClient::DidFailLoad test_runner::WebFrameTestProxy<content::RenderFrameImpl, content::RenderFrameImp Sanitizer: address (ASAN) Recommended Security Severity: High Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=555986:555993 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6678799295709184 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
May 4 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/664698a679a27ce4e752c5c5e5092eb4a32c3866 (Surface synchronization: Simplify resize throttling). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
May 4 2018
The change I made shouldn't affect this call stack at all.
,
May 4 2018
Guessing https://chromium.googlesource.com/chromium/src/+/d83b571dc700010f144b68fe3d8628923c008773 based on regression range. Nasko, feel free to bounce back if I'm wrong. Thanks
,
May 4 2018
Adding rbpotter@ too, since there are two CLs in the range that include print preview work.
,
May 5 2018
Most of the changes in those CLs are adding browser tests for the new Print Preview UI. The few other changes are to code for the componentized UI that is behind a flag that is turned off by default, and I don't see any indication in the report that cluster fuzz turned it on. I also am not sure how print preview changes would cause that stack trace.
,
May 5 2018
The relevant code in content/shell/test_runner/web_frame_test_client.cc has nothing to do with printing.
,
May 5 2018
I think I have an idea why it might be due to my CL, as I got a different report from ClusterFuzz about hitting a CHECK through test code that I fully understand. I'll poke a this next week, but lowering priority and severity as this is likely just test code.
,
May 7 2018
,
May 10 2018
ClusterFuzz has detected this issue as fixed in range 557187:557205. Detailed report: https://clusterfuzz.com/testcase?key=6678799295709184 Fuzzer: inferno_layout_test_unmodified Job Type: mac_asan_content_shell Platform Id: mac Crash Type: Heap-use-after-free READ 8 Crash Address: 0x61100005f2e8 Crash State: test_runner::PrintFrameDescription test_runner::WebFrameTestClient::DidFailLoad test_runner::WebFrameTestProxy<content::RenderFrameImpl, content::RenderFrameImp Sanitizer: address (ASAN) Recommended Security Severity: High Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=555986:555993 Fixed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=557187:557205 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6678799295709184 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
May 10 2018
ClusterFuzz testcase 6678799295709184 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
May 10 2018
,
May 11 2018
,
Jul 27
,
Aug 16
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ClusterFuzz
, May 4 2018