Null-dereference READ in blink::OffscreenCanvas::PushFrame |
||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6028342625828864 Fuzzer: inferno_layout_test_unmodified Job Type: linux_ubsan_vptr_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::OffscreenCanvas::PushFrame blink::OffscreenCanvasRenderingContext2D::PushFrame blink::OffscreenCanvas::BeginFrame Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=576704:576705 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6028342625828864 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jul 21
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
Jul 21
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/e7e9abbb51309caae63f0df4754f5f633bc3da77 (Deeper plumbing of CanvasResource into canvas and OffscreenCanvas). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Jul 22
,
Jul 23
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/4eb4529e5b5eb63bba7afdf80fa6cd7b3d466f22 commit 4eb4529e5b5eb63bba7afdf80fa6cd7b3d466f22 Author: Justin Novosad <junov@chromium.org> Date: Mon Jul 23 23:39:44 2018 Add missing null check to OffscreenCanvas::PushFrame BUG= 866273 Change-Id: Ie53ffb789b005089813f11f26f4425a8f8884b0f Reviewed-on: https://chromium-review.googlesource.com/1147461 Reviewed-by: Fernando Serboncini <fserb@chromium.org> Commit-Queue: Justin Novosad <junov@chromium.org> Cr-Commit-Position: refs/heads/master@{#577326} [modify] https://crrev.com/4eb4529e5b5eb63bba7afdf80fa6cd7b3d466f22/third_party/blink/renderer/core/offscreencanvas/offscreen_canvas.cc
,
Jul 24
ClusterFuzz has detected this issue as fixed in range 577293:577296. Detailed report: https://clusterfuzz.com/testcase?key=6028342625828864 Fuzzer: inferno_layout_test_unmodified Job Type: linux_ubsan_vptr_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::OffscreenCanvas::PushFrame blink::OffscreenCanvasRenderingContext2D::PushFrame blink::OffscreenCanvas::BeginFrame Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=576704:576705 Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=577293:577296 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6028342625828864 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 24
ClusterFuzz testcase 6028342625828864 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jul 24
,
Jul 25
Your change meets the bar and is auto-approved for M69. Please go ahead and merge the CL to branch 3497 manually. Please contact milestone owner if you have questions. Owners: amineer@(Android), kariahda@(iOS), cindyb@(ChromeOS), govind@(Desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jul 25
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c163f8a3020e34f307ff32dc00433914e5c07f5e commit c163f8a3020e34f307ff32dc00433914e5c07f5e Author: Justin Novosad <junov@chromium.org> Date: Wed Jul 25 15:17:26 2018 Add missing null check to OffscreenCanvas::PushFrame BUG= 866273 TBR=junov@chromium.org (cherry picked from commit 4eb4529e5b5eb63bba7afdf80fa6cd7b3d466f22) Change-Id: Ie53ffb789b005089813f11f26f4425a8f8884b0f Reviewed-on: https://chromium-review.googlesource.com/1147461 Reviewed-by: Fernando Serboncini <fserb@chromium.org> Commit-Queue: Justin Novosad <junov@chromium.org> Cr-Original-Commit-Position: refs/heads/master@{#577326} Reviewed-on: https://chromium-review.googlesource.com/1150205 Reviewed-by: Justin Novosad <junov@chromium.org> Cr-Commit-Position: refs/branch-heads/3497@{#69} Cr-Branched-From: 271eaf50594eb818c9295dc78d364aea18c82ea8-refs/heads/master@{#576753} [modify] https://crrev.com/c163f8a3020e34f307ff32dc00433914e5c07f5e/third_party/blink/renderer/core/offscreencanvas/offscreen_canvas.cc |
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by ClusterFuzz
, Jul 21