Null-dereference READ in blink::Node::MutableComputedStyle |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6295165699096576 Fuzzer: ifratric-browserfuzzer-v3 Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000013 Crash State: blink::Node::MutableComputedStyle GetComputedStyle blink::Element::StyleForPseudoElement Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=565667:565668 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6295165699096576 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jul 10
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/2d21d004fa5157a1c4409b19e2f808001d026304 ([Squad] Make pseudo element creation not rely on layout tree.). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Jul 23
,
Jul 23
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/4953b70f39f00c5be23b84aade0084c025cc709b commit 4953b70f39f00c5be23b84aade0084c025cc709b Author: Rune Lillesveen <futhark@chromium.org> Date: Mon Jul 23 20:42:28 2018 [Squad] Re-add null check for layout parent. Because of issue 831568, we may end up trying to generate pseudo elements for element outside the flat tree if we did a getComputedStyle for all non-flat-tree ancestors and then triggered style invalidation of the pseudo element's originating element. This is not a new issue, but [1] boldly tried to make the if-test for a layout parent a DCHECK. This CL is effectively reverting that change. This should ultimately be fixed by fixing 831568 and re-introduce DCHECK instead of the if-test. [1] https://crrev.com/86f6eefc70ed2aa46969754e207198bd6917ee33 Bug: 862098 , 831568 Change-Id: Id10fdbe28592e492ef6903b82d2fc47bff930ea4 Reviewed-on: https://chromium-review.googlesource.com/1146729 Reviewed-by: Anders Ruud <andruud@chromium.org> Commit-Queue: Rune Lillesveen <futhark@chromium.org> Cr-Commit-Position: refs/heads/master@{#577245} [modify] https://crrev.com/4953b70f39f00c5be23b84aade0084c025cc709b/third_party/blink/renderer/core/css/style_engine_test.cc [modify] https://crrev.com/4953b70f39f00c5be23b84aade0084c025cc709b/third_party/blink/renderer/core/dom/element.cc
,
Jul 24
ClusterFuzz has detected this issue as fixed in range 577244:577246. Detailed report: https://clusterfuzz.com/testcase?key=6295165699096576 Fuzzer: ifratric-browserfuzzer-v3 Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000013 Crash State: blink::Node::MutableComputedStyle GetComputedStyle blink::Element::StyleForPseudoElement Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=565667:565668 Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=577244:577246 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6295165699096576 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 24
ClusterFuzz testcase 6295165699096576 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Jul 10Labels: Test-Predator-Auto-Components