New issue
Advanced search Search tips

Issue 864928 link

Starred by 1 user
Status: Duplicate
Merged: issue 895078
Owner:
senorblanco@chromium.org
Closed: Dec 3
Cc:
davidqu@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::CanvasRenderingContext2D::DrawTextInternal

Project Member Reported by ClusterFuzz, Jul 18 
Detailed report: https://clusterfuzz.com/testcase?key=6383296238583808

Fuzzer: inferno_canvas_wrecker
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::CanvasRenderingContext2D::DrawTextInternal
  blink::CanvasRenderingContext2D::fillText
  blink::V8CanvasRenderingContext2D::fillTextMethodCallback
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6383296238583808

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
Project Member

Comment 1 by ClusterFuzz, Jul 18

Components: Blink>Canvas
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 2 by junov@chromium.org, Jul 18

Owner: davidqu@chromium.org
Status: Assigned (was: Untriaged)

Comment 3 by davidqu@chromium.org, Nov 29

Cc: davidqu@chromium.org
Components: -Blink>Canvas Internals>Skia
Owner: senorblanco@chromium.org
This is not crashing anymore in CanvasRenderingContext2D::DrawTextInternal as the report mentions. When trying to reproduce with the test case, I get a segmentation fault in third_party/skia/src/gpu/GrTessellator.cpp:1461:
fatal error: "assert(left->isLeftOf(right->fBottom))

Stephen can you take a look at this?

Comment 4 by senorblanco@chromium.org, Nov 29 

Thanks. This might be a dupe of https://bugs.chromium.org/p/chromium/issues/detail?id=895078.

If it's only an assert, and doesn't crash in release, we could lower the priority.

Comment 5 by fs...@chromium.org, Dec 3

Mergedinto: 895078
Status: Duplicate (was: Assigned)
►

Sign in to add a comment