Null-dereference READ in blink::DocumentLoader::ResponseReceived |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6173787020853248 Fuzzer: inferno_twister Job Type: windows_asan_chrome_no_sandbox Platform Id: windows Crash Type: Null-dereference READ Crash Address: 0x0000000000c2 Crash State: blink::DocumentLoader::ResponseReceived blink::RawResource::DidAddClient blink::Resource::FinishPendingClients Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=565694:565696 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6173787020853248 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jun 16 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/04bf4e5278a018769dbe776cbe722d6b5d102891 (FrameLoader: split start and commit code paths pt1). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Jun 19 2018
,
Jun 23 2018
ClusterFuzz testcase 6173787020853248 appears to be flaky, updating reproducibility label.
,
Jul 12
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/cd7f8b8a57712e9a2b2deb2a10282dea99bdb5eb commit cd7f8b8a57712e9a2b2deb2a10282dea99bdb5eb Author: Dmitry Gozman <dgozman@chromium.org> Date: Thu Jul 12 19:06:57 2018 Restore some checks in FrameLoader::CommitNavigation These were dropped when separating StartNavigation from CommitNavigation. It's reasonable that we cannot be in StopAllLoaders or similar unless there is a nested message loop. See test for an example how print() triggers this stack: ...<message loop running here, dispatched CommitNavigation>... IPC::SyncChannel::Send() content::RenderThreadImpl::Send() printing::PrintRenderFrameHelper::RequestPrintPreview() content::RenderFrameImpl::ScriptedPrint() blink::ChromeClientImpl::PrintDelegate() blink::ChromeClient::Print() blink::LocalDOMWindow::FinishedLoading() blink::FrameLoader::DidFinishNavigation() blink::Document::CheckCompleted() blink::FrameLoader::DetachProvisionalDocumentLoader() blink::DocumentLoader::StopLoading() blink::DocumentLoader::DetachFromFrame() blink::WebDocumentLoaderImpl::DetachFromFrame() blink::FrameLoader::StopAllLoaders() blink::LocalFrame::Detach() blink::HTMLPlugInElement::DisconnectContentFrame() blink::ChildFrameDisconnector::DisconnectCollectedFrameOwners() blink::ContainerNode::WillRemoveChild() blink::ContainerNode::RemoveChild() ...<JavaScript>... Bug: 860208 , 853487 , 862088 Change-Id: Ieb3f0330828f0a031a97d08cdc1ba7de8a3f0edc Reviewed-on: https://chromium-review.googlesource.com/1130223 Commit-Queue: Dmitry Gozman <dgozman@chromium.org> Reviewed-by: Daniel Cheng <dcheng@chromium.org> Cr-Commit-Position: refs/heads/master@{#574661} [add] https://crrev.com/cd7f8b8a57712e9a2b2deb2a10282dea99bdb5eb/third_party/WebKit/LayoutTests/fast/loader/detach-while-printing-expected.txt [add] https://crrev.com/cd7f8b8a57712e9a2b2deb2a10282dea99bdb5eb/third_party/WebKit/LayoutTests/fast/loader/detach-while-printing.html [modify] https://crrev.com/cd7f8b8a57712e9a2b2deb2a10282dea99bdb5eb/third_party/blink/renderer/core/loader/frame_loader.cc
,
Jul 15
ClusterFuzz testcase 6173787020853248 is flaky and no longer crashes, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Jun 16 2018Labels: Test-Predator-Auto-Components