Null-dereference READ in blink::Canvas2DLayerBridge::Hibernate |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6146087199703040 Fuzzer: inferno_canvas_wrecker Job Type: linux_msan_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::Canvas2DLayerBridge::Hibernate base::internal::Invoker<base::internal::BindState<void blink::scheduler::MainThreadSchedulerImpl::RunIdleTask Sanitizer: memory (MSAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6146087199703040 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information. Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
,
Jun 1 2018
Predator and CL could not provide any possible suspects. Using the code search for the file, “main_thread_scheduler_impl.cc” assigning to concern owner from GIT blame. Suspecting Commit# https://chromium.googlesource.com/chromium/src/+/aaf006b519ccb0c73e96a296d185fa37619cc114 @alexclarke -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes. Thank You.
,
Jun 1 2018
I doubt this is scheduler related. In particular I wonder if this is a lifetime issue for Canvas2DLayerBridge::resource_host_? Assinging to junov@ who edited line 207 in Canvas2DLayerBridge::Hibernate which might be where the crash is.
,
Jun 4 2018
The crash site has been refactored since this issue was filed.
,
Jun 11 2018
Issue 851356 has been merged into this issue.
,
Jul 25
,
Aug 1
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, May 31 2018Labels: Test-Predator-Auto-Components