New issue
Advanced search Search tips

Issue 860640 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner:
Closed: Jul 20
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 1
Type: Bug

Blocking:
issue 563816



Sign in to add a comment

Null-dereference READ in v8::internal::FunctionCallbackArguments::Call

Project Member Reported by ClusterFuzz, Jul 6

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5839074800435200

Fuzzer: inferno_twister
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000048
Crash State:
  v8::internal::FunctionCallbackArguments::Call
  v8::internal::MaybeHandle<v8::internal::Object> v8::internal::HandleApiCallHelpe
  v8::internal::Builtin_Impl_HandleApiCall
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=570345:570348

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5839074800435200

Additional requirements: Requires HTTP

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jul 6

Components: Blink>JavaScript
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jul 12

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 5839074800435200 appears to be flaky, updating reproducibility label.
Components: -Blink>JavaScript Blink>WebGL
Does not reproduce, and does not look v8 related.

Seems to fail in third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc:746.
Updating component, maybe WebGL folks now how to reproduce this.
Labels: Test-Predator-Wrong CF-NeedsTriage
Unable to provide possible suspect using Predator, CL and Code Search.
Could someone please look into the issue.

Thank You...
Blocking: 563816
Components: Blink>Canvas
Owner: fs...@chromium.org
Status: Assigned (was: Untriaged)
Searching through the test's code I don't see a call to WebGLRenderingContext's commit(), but looking at it, I think the implementation of commit() is wrong. It first needs to call into the CanvasRenderingContextHost to see whether commit() is supported, before doing any work or calling GetStaticBitmapImage.

commit() is also guarded under a command-line flag which I don't think Clusterfuzz is specifying, so I doubt that this stack trace is accurate.

Fernando could you still guard the body of commit() in this way? Thanks.


	SCARINESS: 10 (null-deref)
#0 0x11c07675c in std::__1::__compressed_pair_elem<viz::SingleReleaseCallback*, 0, false>::__compressed_pair_elem<viz::SingleReleaseCallback*, void>(viz::SingleReleaseCallback*&&) third_party/llvm-build/Release+Asserts/include/c++/v1/memory:0:9
#1 0x11c07675c in std::__1::__compressed_pair<viz::SingleReleaseCallback*, std::__1::default_delete<viz::SingleReleaseCallback> >::__compressed_pair<viz::SingleReleaseCallback*, true>(viz::SingleReleaseCallback*&&) third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2223
#2 0x11c07675c in std::__1::__compressed_pair<viz::SingleReleaseCallback*, std::__1::default_delete<viz::SingleReleaseCallback> >::__compressed_pair<viz::SingleReleaseCallback*, true>(viz::SingleReleaseCallback*&&) third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2223
#3 0x11c07675c in std::__1::unique_ptr<viz::SingleReleaseCallback, std::__1::default_delete<viz::SingleReleaseCallback> >::unique_ptr<true, void>() third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2443
#4 0x11c07675c in std::__1::unique_ptr<viz::SingleReleaseCallback, std::__1::default_delete<viz::SingleReleaseCallback> >::unique_ptr<true, void>() third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2443
#5 0x11c07675c in blink::WebGLRenderingContextBase::commit() third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc:746
 #6 0x10cc770fc in v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo*) v8/src/api-arguments-inl.h:95:3
#7 0x10cc740b2 in v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) v8/src/builtins/builtins-api.cc:110:36
 #8 0x10cc7193e in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-api.cc:140:5
    #9 0x10e8d0b8d in v8_Default_embedded_blob_
#5 0x7eda52b086a5  (<unknown module>)


The test case isn't calling comm
Project Member

Comment 6 by ClusterFuzz, Jul 20

Status: WontFix (was: Assigned)
ClusterFuzz testcase 5839074800435200 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment