New issue
Advanced search Search tips

Issue 847840 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in v8::Context::Global

Project Member Reported by ClusterFuzz, May 30 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6328662702686208

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  v8::Context::Global
  blink::ToExecutionContext
  blink::ExecutionContext::From
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=558335:558337

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6328662702686208

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 30 2018

Components: Blink>Bindings Blink>Internals>Frames
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, May 30 2018

Labels: Test-Predator-Auto-Owner
Owner: joedow@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/386ea32692c1e8f1fa7866d90400496986e8d497 ([KeyboardLock] Enable keyboard-lock API by default).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

Comment 3 by joedow@chromium.org, May 31 2018

Status: Started (was: Assigned)
Stack trace:
#0 0x55eedcf34c80 in v8::Context::Global() v8/src/api.cc:6351
#1 0x55eee3d2f72d in blink::ToExecutionContext(v8::Local<v8::Context>) third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.cc:662:49
#2 0x55eee464b7cd in blink::ExecutionContext::From(blink::ScriptState const*) third_party/blink/renderer/core/execution_context/execution_context.cc:61:10
#3 0x55eee6385d44 in blink::ClipboardPromise::RequestReadPermission(base::OnceCallback<void (blink::mojom::PermissionStatus)>) third_party/blink/renderer/modules/clipboard/clipboard_promise.cc:105:31
#4 0x55eee6385442 in blink::ClipboardPromise::HandleReadText() third_party/blink/renderer/modules/clipboard/clipboard_promise.cc:166:3
#5 0x55eeda68342f in base::OnceCallback<void ()>::Run() && base/callback.h:96:12
#6 0x55eede3a42ee in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101:33
#7 0x55eedd8cdac3 in base::sequence_manager::internal::ThreadControllerImpl::DoWork(base::sequence_manager::internal::ThreadControllerImpl::WorkType) third_party/blink/renderer/platform/scheduler/base/thread_controller_impl.cc:166:21
#8 0x55eeda68342f in base::OnceCallback<void ()>::Run() && base/callback.h:96:12
#9 0x55eede3a42ee in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:101:33

I'll see if I can reproduce locally and debug.
Project Member

Comment 4 by ClusterFuzz, Jun 2 2018

ClusterFuzz has detected this issue as fixed in range 563877:563878.

Detailed report: https://clusterfuzz.com/testcase?key=6328662702686208

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  v8::Context::Global
  blink::ToExecutionContext
  blink::ExecutionContext::From
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=558335:558337
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=563877:563878

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6328662702686208

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Jun 2 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 6328662702686208 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment