Null-dereference READ in blink::LayoutTextFragment::GetFirstLetterPart |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4759551849791488 Fuzzer: marty_html_twiddler Job Type: windows_asan_chrome_no_sandbox Platform Id: windows Crash Type: Null-dereference READ Crash Address: 0x000000000010 Crash State: blink::LayoutTextFragment::GetFirstLetterPart blink::AssociatedLayoutObjectOf blink::FirstLetterPartFor Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=569233:569235 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4759551849791488 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jun 24 2018
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
Jun 25 2018
yoichio@, could you take look?
It seems ResetOldSelectedLayoutObjects() uses LayoutObject being removed.
In below sample, it is LayoutTextFragment associated to Text node "def".
LayoutTextFragment::first_letter_pseudo_element_ is null
# Minimal HTML to reproduce
<!doctype html>
<style>
.c14::first-letter { font-weight: bold; }
</style>
<body>
<p>abc</p><p id="sample" class="c14">def</p>
<script>
const sample = document.getElementById('sample');
document.execCommand('SelectAll');
let counter = 0;
setTimeout(() => {
if (++counter != 1)
return;
// Invoke LayoutSelection::ClearSelection() after reload.
window.location.reload();
sample.textContent = '';
}, 0);
</script>
</body>
# Stack trace
Node::GetFlag(blink::Node::NodeFlags mask) Line 906
Node::HasRareData() Line 951
Node::GetLayoutObject() Line 625
LayoutTextFragment::GetFirstLetterPart() Line 168
AssociatedLayoutObjectOf(const blink::Node & node, int offset_in_node, blink::LayoutObjectSide object_side) Line 4033
FirstLetterPartFor(const blink::LayoutObject * layout_object) Line 85
NextLayoutObjectOnFlatTree(const blink::LayoutObject & layout_object) Line 108
SelectionPaintRange::Iterator::operator++() Line 131
ResetOldSelectedLayoutObjects(const blink::SelectionPaintRange & old_range) Line 399
LayoutSelection::ClearSelection() Line 431
FrameSelection::ClearLayoutSelection() Line 1229
LayoutView::ClearSelection() Line 593
LayoutObjectChildList::RemoveChildNode(blink::LayoutObject * owner, blink::LayoutObject * old_child, bool notify_layout_object) Line 111
LayoutObject::RemoveChild(blink::LayoutObject * old_child) Line 392
LayoutBlockFlow::RemoveChild(blink::LayoutObject * old_child) Line 3248
LayoutObject::Remove() Line 1626
LayoutObject::WillBeDestroyed() Line 3042
LayoutText::WillBeDestroyed() Line 213
LayoutTextFragment::WillBeDestroyed() Line 76
LayoutObject::Destroy() Line 3314
LayoutObject::DestroyAndCleanupAnonymousWrappers() Line 3310
Node::DetachLayoutTree(const blink::Node::AttachContext & context) Line 1123
ContainerNode::RemoveBetween(blink::Node * previous_child, blink::Node * next_child, blink::Node & old_child) Line 734
ContainerNode::RemoveChildren(blink::SubtreeModificationAction action) Line 814
Node::setTextContent(const WTF::String & text) Line 1514
NodeV8Internal::textContentAttributeSetter(v8::Local<v8::Value> v8Value, const v8::FunctionCallbackInfo<v8::Value> & info) Line 289
,
Jun 25 2018
,
Jun 25 2018
Issue 855183 has been merged into this issue.
,
Jun 25 2018
,
Jun 26 2018
,
Jun 29 2018
ClusterFuzz has detected this issue as fixed in range 571075:571076. Detailed report: https://clusterfuzz.com/testcase?key=4759551849791488 Fuzzer: marty_html_twiddler Job Type: windows_asan_chrome_no_sandbox Platform Id: windows Crash Type: Null-dereference READ Crash Address: 0x000000000010 Crash State: blink::LayoutTextFragment::GetFirstLetterPart blink::AssociatedLayoutObjectOf blink::FirstLetterPartFor Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=569233:569235 Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=571075:571076 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4759551849791488 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Jun 24 2018Owner: yosin@chromium.org
Status: Assigned (was: Untriaged)