Null-dereference READ in blink::PaintPropertyTreeBuilder::UpdateForSelf |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5213734256246784 Fuzzer: miaubiz_css_fuzzer Job Type: linux_msan_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000020 Crash State: blink::PaintPropertyTreeBuilder::UpdateForSelf blink::PrePaintTreeWalk::WalkInternal blink::PrePaintTreeWalk::Walk Sanitizer: memory (MSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=563137:563138 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5213734256246784 Additional requirements: Requires Gestures Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jun 1 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/4ed270af2dfc4dc15c8306978c6774031a0ad1db ([SPv175+] Fix printing of objects with paint offset translation in repeating table sections). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Jun 1 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/b3e5f4ed28d05b96dad20c25705add028d87ee11 commit b3e5f4ed28d05b96dad20c25705add028d87ee11 Author: Xianzhu Wang <wangxianzhu@chromium.org> Date: Fri Jun 01 18:54:46 2018 [PE] Fix printing empty thead Bug: 848680 , 847307 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2 Change-Id: Iecb25f5441574763eb96b4ecf68a980610ce3869 Reviewed-on: https://chromium-review.googlesource.com/1081879 Reviewed-by: Chris Harrelson <chrishtr@chromium.org> Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org> Cr-Commit-Position: refs/heads/master@{#563741} [add] https://crrev.com/b3e5f4ed28d05b96dad20c25705add028d87ee11/third_party/WebKit/LayoutTests/printing/empty-thead-crash-expected.txt [add] https://crrev.com/b3e5f4ed28d05b96dad20c25705add028d87ee11/third_party/WebKit/LayoutTests/printing/empty-thead-crash.html [add] https://crrev.com/b3e5f4ed28d05b96dad20c25705add028d87ee11/third_party/WebKit/LayoutTests/printing/thead-tfoot-in-one-page-expected.html [add] https://crrev.com/b3e5f4ed28d05b96dad20c25705add028d87ee11/third_party/WebKit/LayoutTests/printing/thead-tfoot-in-one-page.html [modify] https://crrev.com/b3e5f4ed28d05b96dad20c25705add028d87ee11/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
,
Jun 2 2018
ClusterFuzz has detected this issue as fixed in range 563740:563741. Detailed report: https://clusterfuzz.com/testcase?key=5213734256246784 Fuzzer: miaubiz_css_fuzzer Job Type: linux_msan_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000020 Crash State: blink::PaintPropertyTreeBuilder::UpdateForSelf blink::PrePaintTreeWalk::WalkInternal blink::PrePaintTreeWalk::Walk Sanitizer: memory (MSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=563137:563138 Fixed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=563740:563741 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5213734256246784 Additional requirements: Requires Gestures See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jun 2 2018
ClusterFuzz testcase 5213734256246784 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by ClusterFuzz
, Jun 1 2018Labels: Test-Predator-Auto-Components