Float-cast-overflow in blink::LayoutFrameSet::UpdateLayout |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4936008114896896 Fuzzer: ifratric-browserfuzzer-v3 Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Float-cast-overflow Crash Address: Crash State: blink::LayoutFrameSet::UpdateLayout LayoutIfNeeded blink::LayoutMultiColumnSpannerPlaceholder::UpdateLayout Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=563472:563900 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4936008114896896 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jun 21 2018
Automatically adding ccs based on suspected regression changelists:
[LayoutNG] Make Layout{BlockFlow,FlexibleBox}::CreateAnonymous() to take ComputedStyle by yosin@chromium.org - https://chromium.googlesource.com/chromium/src/+/fa5f9c02ecd9b08736acdd5c724503174c2e6a88
[css-contain] Disable size containment for certain elements by rego@igalia.com - https://chromium.googlesource.com/chromium/src/+/cd1672b012e2eef90d0d6c7e227200dbda98fff1
If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Jun 25 2018
First, I cannot reproduce the issue. I've built with: is_component_build = false is_debug = false is_ubsan = true strip_absolute_paths_from_debug_symbols = true But I cannot get a trace like the one in clusterfuzz opening the testcase. Probably I'm missing something. In any case I don't see any usage of "contain: size" on the testcase, so on a first sight it shouldn't be related to my change.
,
Jun 25 2018
,
Jul 2
ClusterFuzz testcase 4936008114896896 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Jun 21 2018Labels: Test-Predator-Auto-Components