New issue
Advanced search Search tips

Issue 853055 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::ResourceFetcher::MatchPreload

Project Member Reported by ClusterFuzz, Jun 15 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5122937372540928

Fuzzer: inferno_webbot
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x0000000000d0
Crash State:
  blink::ResourceFetcher::MatchPreload
  blink::ResourceFetcher::RequestResource
  blink::ScriptResource::Fetch
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=567206:567207

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5122937372540928

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jun 15 2018

Components: Blink>Loader
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jun 15 2018

Labels: Test-Predator-Auto-Owner
Owner: mlippautz@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/1ef408b10e1809223c6939c68657fa53c64e9c07 ([oilpan] Fix LargeObjectPage sizes).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Cc: mlippautz@chromium.org
 Issue 852839  has been merged into this issue.
Cc: jbroman@chromium.org
 Issue 852956  has been merged into this issue.
Mergedinto: 852956
Status: Duplicate (was: Assigned)
Cc: -mlippautz@chromium.org
Status: Assigned (was: Duplicate)
Components: -Blink>Loader Blink>MemoryAllocator>GarbageCollection
Status: Started (was: Assigned)
Project Member

Comment 8 by bugdroid1@chromium.org, Jun 15 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b0fd211f0a1557130f8c192802122d75597eaeb8

commit b0fd211f0a1557130f8c192802122d75597eaeb8
Author: Michael Lippautz <mlippautz@chromium.org>
Date: Fri Jun 15 05:38:43 2018

[oilpan] LargeObject payload fix

No-try: true
Bug:  chromium:853055 ,  chromium:847679 ,  chromium:852980 
Change-Id: I019eea9d101cbd8e368607e6309a99b0e9779cc2
Reviewed-on: https://chromium-review.googlesource.com/1101605
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#567561}
[modify] https://crrev.com/b0fd211f0a1557130f8c192802122d75597eaeb8/third_party/blink/renderer/platform/heap/heap_page.h

Project Member

Comment 9 by bugdroid1@chromium.org, Jun 15 2018

Labels: merge-merged-3461
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/09704f44b190b6b8fbccb5358768fc49647dc056

commit 09704f44b190b6b8fbccb5358768fc49647dc056
Author: Michael Lippautz <mlippautz@chromium.org>
Date: Fri Jun 15 06:16:52 2018

[oilpan] LargeObject payload fix

No-try: true
Bug:  chromium:853055 ,  chromium:847679 ,  chromium:852980 , chromium:853090
Change-Id: I019eea9d101cbd8e368607e6309a99b0e9779cc2
Reviewed-on: https://chromium-review.googlesource.com/1101605
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#567561}(cherry picked from commit b0fd211f0a1557130f8c192802122d75597eaeb8)
Reviewed-on: https://chromium-review.googlesource.com/1102257
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/branch-heads/3461@{#3}
Cr-Branched-From: c8a271c2b9964bd832b32a9a143f7bf28b658e70-refs/heads/master@{#567544}
[modify] https://crrev.com/09704f44b190b6b8fbccb5358768fc49647dc056/third_party/blink/renderer/platform/heap/heap_page.h

Status: Fixed (was: Started)
Project Member

Comment 11 by ClusterFuzz, Jun 15 2018

ClusterFuzz has detected this issue as fixed in range 567526:567527.

Detailed report: https://clusterfuzz.com/testcase?key=5122937372540928

Fuzzer: inferno_webbot
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x0000000000d0
Crash State:
  blink::ResourceFetcher::MatchPreload
  blink::ResourceFetcher::RequestResource
  blink::ScriptResource::Fetch
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=567206:567207
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=567526:567527

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5122937372540928

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 12 by wfh@chromium.org, Jun 15 2018

 Issue 853075  has been merged into this issue.
Status: Available (was: Fixed)
Status: Fixed (was: Available)
Status: Available (was: Fixed)
Status: Fixed (was: Available)
Ignore last few comments, i want to get rid of "Merged:	 issue 852956 "
see https://bugs.chromium.org/p/monorail/issues/detail?id=3920
Cc: mlippautz@chromium.org
 Issue 852956  has been merged into this issue.
Mergedinto: -852956 853454
Status: Duplicate (was: Fixed)
 Issue 853075  has been merged into this issue.
Mergedinto: -853454 852956
 Issue 852956  has been merged into this issue.

Sign in to add a comment