Null-dereference READ in v8::internal::FunctionCallbackArguments::Call |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5839074800435200 Fuzzer: inferno_twister Job Type: mac_asan_content_shell Platform Id: mac Crash Type: Null-dereference READ Crash Address: 0x000000000048 Crash State: v8::internal::FunctionCallbackArguments::Call v8::internal::MaybeHandle<v8::internal::Object> v8::internal::HandleApiCallHelpe v8::internal::Builtin_Impl_HandleApiCall Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=570345:570348 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5839074800435200 Additional requirements: Requires HTTP Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jul 12
ClusterFuzz testcase 5839074800435200 appears to be flaky, updating reproducibility label.
,
Jul 18
Does not reproduce, and does not look v8 related. Seems to fail in third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc:746. Updating component, maybe WebGL folks now how to reproduce this.
,
Jul 18
Unable to provide possible suspect using Predator, CL and Code Search. Could someone please look into the issue. Thank You...
,
Jul 18
Searching through the test's code I don't see a call to WebGLRenderingContext's commit(), but looking at it, I think the implementation of commit() is wrong. It first needs to call into the CanvasRenderingContextHost to see whether commit() is supported, before doing any work or calling GetStaticBitmapImage.
commit() is also guarded under a command-line flag which I don't think Clusterfuzz is specifying, so I doubt that this stack trace is accurate.
Fernando could you still guard the body of commit() in this way? Thanks.
SCARINESS: 10 (null-deref)
#0 0x11c07675c in std::__1::__compressed_pair_elem<viz::SingleReleaseCallback*, 0, false>::__compressed_pair_elem<viz::SingleReleaseCallback*, void>(viz::SingleReleaseCallback*&&) third_party/llvm-build/Release+Asserts/include/c++/v1/memory:0:9
#1 0x11c07675c in std::__1::__compressed_pair<viz::SingleReleaseCallback*, std::__1::default_delete<viz::SingleReleaseCallback> >::__compressed_pair<viz::SingleReleaseCallback*, true>(viz::SingleReleaseCallback*&&) third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2223
#2 0x11c07675c in std::__1::__compressed_pair<viz::SingleReleaseCallback*, std::__1::default_delete<viz::SingleReleaseCallback> >::__compressed_pair<viz::SingleReleaseCallback*, true>(viz::SingleReleaseCallback*&&) third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2223
#3 0x11c07675c in std::__1::unique_ptr<viz::SingleReleaseCallback, std::__1::default_delete<viz::SingleReleaseCallback> >::unique_ptr<true, void>() third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2443
#4 0x11c07675c in std::__1::unique_ptr<viz::SingleReleaseCallback, std::__1::default_delete<viz::SingleReleaseCallback> >::unique_ptr<true, void>() third_party/llvm-build/Release+Asserts/include/c++/v1/memory:2443
#5 0x11c07675c in blink::WebGLRenderingContextBase::commit() third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc:746
#6 0x10cc770fc in v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo*) v8/src/api-arguments-inl.h:95:3
#7 0x10cc740b2 in v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) v8/src/builtins/builtins-api.cc:110:36
#8 0x10cc7193e in v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) v8/src/builtins/builtins-api.cc:140:5
#9 0x10e8d0b8d in v8_Default_embedded_blob_
#5 0x7eda52b086a5 (<unknown module>)
The test case isn't calling comm
,
Jul 20
ClusterFuzz testcase 5839074800435200 is flaky and no longer crashes, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, Jul 6Labels: Test-Predator-Auto-Components