MostForwardCaretPosition() crashes with empty Text node |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6173613074677760 Fuzzer: bj_broddelwerk Job Type: linux_debug_chrome Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: static_cast<unsigned>(offset) <= ToCharacterData(anchor_node_)->length() (1 vs. blink::PositionTemplate<blink::EditingAlgorithm<blink::NodeTraversal> >::Positio blink::PositionTemplate<blink::EditingAlgorithm<blink::NodeTraversal> >::Editing Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=547593:547597 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6173613074677760 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jun 18 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/c8a34cf719bcf005b2e29ca6fba37c6a35505b57 (Validate offset parameter of Position constructor with introducing Position::CreateWithoutValidation()). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Jun 20 2018
MostForwardCaretPosition() calls Position("", 1) for empty Text node.
,
Jul 7
ClusterFuzz has detected this issue as fixed in range 572928:572930. Detailed report: https://clusterfuzz.com/testcase?key=6173613074677760 Fuzzer: bj_broddelwerk Job Type: linux_debug_chrome Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: static_cast<unsigned>(offset) <= ToCharacterData(anchor_node_)->length() (1 vs. blink::PositionTemplate<blink::EditingAlgorithm<blink::NodeTraversal> >::Positio blink::PositionTemplate<blink::EditingAlgorithm<blink::NodeTraversal> >::Editing Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=547593:547597 Fixed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=572928:572930 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6173613074677760 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 7
ClusterFuzz testcase 6173613074677760 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Jun 18 2018Labels: Test-Predator-Auto-Components