New issue
Advanced search Search tips

Issue 849088 link

Starred by 1 user

Issue metadata

Status: Verified
Owner: ----
Closed: Oct 24
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

Bad-cast to blink::WebView from invalid vptr in test_runner::TestRunnerForSpecificView::Reset

Project Member Reported by ClusterFuzz, Jun 3 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5270720687636480

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_ubsan_vptr_content_shell_drt
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x2d221da98500
Crash State:
  Bad-cast to blink::WebView from invalid vptr
  test_runner::TestRunnerForSpecificView::Reset
  test_runner::WebViewTestProxyBase::Reset
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=549412:549420

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5270720687636480

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jun 3 2018

Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by sheriffbot@chromium.org, Jun 3 2018

Labels: M-68 Target-68
Project Member

Comment 3 by sheriffbot@chromium.org, Jun 3 2018

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by sheriffbot@chromium.org, Jun 3 2018

Labels: Pri-1
Project Member

Comment 5 by sheriffbot@chromium.org, Jun 4 2018

Labels: -Security_Impact-Head Security_Impact-Beta
Components: Blink>Layout
Owner: tkent@chromium.org
Status: Assigned (was: Untriaged)
https://chromium.googlesource.com/chromium/src/+/cd81d2e64ffd7f6cace01432abe8b59b978914cd%5E%21/ in the regression range fixes blacklisting for files named lifecycle_observer. It shouldn't be the CL that introduced the bug, but then again I don't see anything that might be relevant either.

tkent: Could you please take a look as the author of that CL?

Comment 7 by tkent@chromium.org, Jun 5 2018

Components: -Blink>Layout Blink>Infra
Labels: -Type-Bug-Security -Pri-1 -Restrict-View-SecurityTeam -Security_Severity-High -Security_Impact-Beta -ReleaseBlock-Stable -M-68 -Target-68 Pri-2 Type-Bug
TestRunnerForSpecificView is not production code.
Yes, my CL can't cause this issue. But I'll take a look at this as a code owner.

Cc: tkent@chromium.org
Owner: ----
Status: Available (was: Assigned)
I couldn't reproduce this locally.

Labels: -Pri-2 Pri-3
Downgrading to P3 because of the reason given in #7: TestRunnerForSpecificView is not production code
Project Member

Comment 10 by ClusterFuzz, Oct 24

ClusterFuzz has detected this issue as fixed in range 602138:602139.

Detailed report: https://clusterfuzz.com/testcase?key=5270720687636480

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_ubsan_vptr_content_shell_drt
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x2d221da98500
Crash State:
  Bad-cast to blink::WebView from invalid vptr
  test_runner::TestRunnerForSpecificView::Reset
  test_runner::WebViewTestProxyBase::Reset
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=549412:549420
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=602138:602139

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5270720687636480

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Oct 24

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 5270720687636480 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment