New issue
Advanced search Search tips

Issue 858917 link

Starred by 3 users

Issue metadata

Status: WontFix
Owner:
Closed: Dec 14
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Integer-overflow in blink::LayoutFrameSet::UpdateLayout

Project Member Reported by ClusterFuzz, Jun 29 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5194601586229248

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  blink::LayoutFrameSet::UpdateLayout
  LayoutIfNeeded
  blink::GridTrackSizingAlgorithmStrategy::LogicalHeightForChild
  
Sanitizer: undefined (UBSAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5194601586229248

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jun 29 2018

Components: Blink>Layout
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: kkaluri@chromium.org
Labels: M-68 Test-Predator-Wrong
Owner: jfernandez@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.

Using Code Search for the file, "grid_track_sizing_algorithm.cc" suspecting the below Cl might have caused this issue

Suspect CL: https://chromium.googlesource.com/chromium/src/+/75d24bd94da41caf2a6a0061b3ae528a7528a79e

jfernandez@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!
Owner: jfernan...@igalia.com
Umm, I cannot reproduce it in today's ToT (linux) 
It's not reproducible in the following versions either:

 * Google Chrome	69.0.3472.3 (Official Build) dev (64-bit)
 * Google Chrome	68.0.3440.42 (Official Build) beta (64-bit)
Labels: Test-Predator-Wrong-Components
I tried to build at the specific suspicious commit and I'm still unable to reproduce the issue. In my opinion, it's not the root cause of the issue. 
Labels: -Test-Predator-Auto-Components Test-Predator-Wrong-CLs
Owner: kkaluri@chromium.org
Status: Unconfirmed (was: Assigned)
Owner: jfernan...@igalia.com
Status: Assigned (was: Unconfirmed)
I think I managed to reproduce the issue. 
Labels: -Test-Predator-Wrong-CLs
I think I managed to reproduce the issue. 
Status: Assigned (was: Unconfirmed)
Owner: kkaluri@chromium.org
Status: Available (was: Assigned)
Hi, I can reproduce the issue even in versions earlier (r564745) than the one the suspected CL belongs to (r564950), so definitively it's not the root cause of this bug.
Cc: jfernan...@igalia.com
Status: Assigned (was: Available)
Status: WontFix (was: Assigned)
Non-security numeric overflow bugs are considered won't fix.
Project Member

Comment 17 by ClusterFuzz, Dec 21

Labels: Needs-Feedback
ClusterFuzz testcase 5194601586229248 is still reproducing on tip-of-tree build (trunk).

If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase.

Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.

Sign in to add a comment