New issue
Advanced search Search tips

Issue 840174 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: May 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 2
Type: Bug-Security



Sign in to add a comment

Heap-use-after-free in test_runner::WebWidgetTestClient::AnimateNow

Project Member Reported by ClusterFuzz, May 6 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6587645728391168

Fuzzer: inferno_twister
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x6160000a2080
Crash State:
  test_runner::WebWidgetTestClient::AnimateNow
  base::debug::TaskAnnotator::RunTask
  blink::scheduler::internal::ThreadControllerImpl::DoWork
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=547334:547352

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6587645728391168

Additional requirements: Requires HTTP

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 6 2018

Labels: OS-Linux
Project Member

Comment 2 by ClusterFuzz, May 6 2018

Components: Blink>Scheduling Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 3 by ClusterFuzz, May 6 2018

Cc: dgozman@chromium.org panicker@chromium.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

POC for considering keep-active signal for freezing per-frame task queues. by panicker@chromium.org - https://chromium.googlesource.com/chromium/src/+/0ea1764907cc5bc5d1a7d500561a0e3af5e3425b

[DevTools] Produce tracks in TimelineModel by dgozman@chromium.org - https://chromium.googlesource.com/chromium/src/+/71ddc59fed6180e3a2c5ea2ca43f076ef5a73ea2

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 4 by sheriffbot@chromium.org, May 6 2018

Labels: M-67
Project Member

Comment 5 by sheriffbot@chromium.org, May 6 2018

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 6 by sheriffbot@chromium.org, May 6 2018

Labels: Pri-1
*** Bulk Edit ***
M67 Stable promotion is coming VERY soon. Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and request a merge into the release branch ASAP. 

If fix is already merged to M67 and nothing else is pending, pls mark the bug as fixed. Thank you.
Labels: -OS-Linux -Pri-1 -Security_Severity-High Security_severity-None Pri-2
Issue appears to be in the test code, not the shipping browser.
Owner: khushals...@chromium.org
khushal, you were working in the web_widget_test_client.cc animate code some time ago, could you take a look and/or re-assign as appropriate?  Thanks!
Labels: -Security_Impact-Beta -ReleaseBlock-Stable
Sure, I'll take a look. Removing RB labels since this is in test code only.
My account does not have permission to access the report?
Labels: -Security_severity-None Security_Severity-High Security_Impact-None
(proper labels to represent comment 8)
Project Member

Comment 13 by sheriffbot@chromium.org, May 8 2018

Status: Assigned (was: Untriaged)
Project Member

Comment 14 by ClusterFuzz, May 17 2018

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 6587645728391168 appears to be flaky, updating reproducibility label.
Project Member

Comment 15 by ClusterFuzz, May 26 2018

Status: WontFix (was: Assigned)
ClusterFuzz testcase 6587645728391168 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 16 by sheriffbot@chromium.org, Sep 2

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment