Null-dereference READ in blink::V8Window::getComputedAccessibleNodeMethodCallback |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5717344513687552 Fuzzer: inferno_twister Job Type: mac_asan_content_shell Platform Id: mac Crash Type: Null-dereference READ Crash Address: 0x000000000050 Crash State: blink::V8Window::getComputedAccessibleNodeMethodCallback v8::internal::FunctionCallbackArguments::Call v8::internal::MaybeHandle<v8::internal::Object> v8::internal::HandleApiCallHelpe Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=537693:537712 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5717344513687552 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jul 19
third_party/blink/renderer/core/page/page.h:
197 Settings& GetSettings() const { return *settings_; }
This fails since settings_ is a nullptr.
Called from here:
third_party/blink/renderer/core/frame/local_dom_window.cc:
1111 element->GetDocument().GetPage()->GetSettings().SetAccessibilityEnabled(true);
The CL which added this line (06bafdfb50ee7ede3709742290c256e60ad50bdb) is contained in the regression range. Assigning to the author.
,
Jul 19
,
Jul 30
,
Aug 24
ClusterFuzz has detected this issue as fixed in range 585574:585607. Detailed report: https://clusterfuzz.com/testcase?key=5717344513687552 Fuzzer: inferno_twister Job Type: mac_asan_content_shell Platform Id: mac Crash Type: Null-dereference READ Crash Address: 0x000000000050 Crash State: blink::V8Window::getComputedAccessibleNodeMethodCallback v8::internal::FunctionCallbackArguments::Call v8::internal::MaybeHandle<v8::internal::Object> v8::internal::HandleApiCallHelpe Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=537693:537712 Fixed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=585574:585607 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5717344513687552 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 24
ClusterFuzz testcase 5717344513687552 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Jul 11Labels: Test-Predator-Auto-Components