New issue
Advanced search Search tips

Issue 862904 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 3
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 2
Type: Bug



Sign in to add a comment

CHECK failure: event.GetType() != WebInputEvent::kGestureFlingCancel in web_view_impl.cc

Project Member Reported by ClusterFuzz, Jul 12

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5835753003941888

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  event.GetType() != WebInputEvent::kGestureFlingCancel in web_view_impl.cc
  blink::WebViewImpl::HandleGestureEvent
  blink::PageWidgetDelegate::HandleInputEvent
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5835753003941888

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jul 12

Labels: OS-Mac
Cc: kkaluri@chromium.org
Components: Internals
Labels: M-69 Test-Predator-Wrong
Owner: sahel@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.

Using Code Search for the file, "web_view_impl.cc" suspecting the below Cl might have caused this issue

Suspect CL: https://chromium.googlesource.com/chromium/src/+/4b723c9447cfc8e917ab667710f7790431da9d3b

sahel@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!
Project Member

Comment 3 by ClusterFuzz, Jul 13

Labels: OS-Windows
Labels: -Pri-1 Pri-2
Since M67, fling is handled on the browser, which means that GFC and GFS event are not sent to the renderer. The suspected cl cleans up the fling handling logic in the renderer and adds checks to make sure that the renderer doesn't receive GFC or GFS events.

The check failure happens since the test case uses event_sender to generate a fling cancel event (eventSender.gestureFlingCancel). The event sender directly injects events to main thread and it hits this check. The solution here is to delete the test case.
I want to delete this test case and from http://dev.chromium.org/Home/chromium-security/bugs/using-clusterfuzz#TOC-Delete-a-test-case, I found "If for any reason it makes sense to delete a test case, this can be done from the test case details page. Use the “delete” button and follow the prompts to delete the test case if you are sure that it should be deleted."

When I check "https://clusterfuzz.com/v2/testcase-detail/5835753003941888" I cannot find any "delete" buttons, am I missing something?
Project Member

Comment 6 by ClusterFuzz, Jul 21

Components: Blink
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Components: -Blink Blink>Input
Components: -Internals
Project Member

Comment 9 by ClusterFuzz, Jan 3

ClusterFuzz has detected this issue as fixed in range 619628:619629.

Detailed report: https://clusterfuzz.com/testcase?key=5835753003941888

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  event.GetType() != WebInputEvent::kGestureFlingCancel in web_view_impl.cc
  blink::WebViewImpl::HandleGestureEvent
  blink::PageWidgetDelegate::HandleInputEvent
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=574235:574247
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=619628:619629

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5835753003941888

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Jan 3

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5835753003941888 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment