Issue metadata
Sign in to add a comment
|
Heap-use-after-free in test_runner::WebWidgetTestClient::AnimateNow |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6587645728391168 Fuzzer: inferno_twister Job Type: mac_asan_content_shell Platform Id: mac Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6160000a2080 Crash State: test_runner::WebWidgetTestClient::AnimateNow base::debug::TaskAnnotator::RunTask blink::scheduler::internal::ThreadControllerImpl::DoWork Sanitizer: address (ASAN) Recommended Security Severity: High Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=547334:547352 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6587645728391168 Additional requirements: Requires HTTP Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
May 6 2018
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
May 6 2018
Automatically adding ccs based on suspected regression changelists: POC for considering keep-active signal for freezing per-frame task queues. by panicker@chromium.org - https://chromium.googlesource.com/chromium/src/+/0ea1764907cc5bc5d1a7d500561a0e3af5e3425b [DevTools] Produce tracks in TimelineModel by dgozman@chromium.org - https://chromium.googlesource.com/chromium/src/+/71ddc59fed6180e3a2c5ea2ca43f076ef5a73ea2 If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
May 6 2018
,
May 6 2018
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it. If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
May 6 2018
,
May 7 2018
*** Bulk Edit *** M67 Stable promotion is coming VERY soon. Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and request a merge into the release branch ASAP. If fix is already merged to M67 and nothing else is pending, pls mark the bug as fixed. Thank you.
,
May 7 2018
Issue appears to be in the test code, not the shipping browser.
,
May 7 2018
khushal, you were working in the web_widget_test_client.cc animate code some time ago, could you take a look and/or re-assign as appropriate? Thanks!
,
May 7 2018
Sure, I'll take a look. Removing RB labels since this is in test code only.
,
May 7 2018
My account does not have permission to access the report?
,
May 8 2018
(proper labels to represent comment 8)
,
May 8 2018
,
May 17 2018
ClusterFuzz testcase 6587645728391168 appears to be flaky, updating reproducibility label.
,
May 26 2018
ClusterFuzz testcase 6587645728391168 is flaky and no longer crashes, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Sep 2
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ClusterFuzz
, May 6 2018