New issue
Advanced search Search tips

Issue 867833 link

Starred by 1 user

Issue metadata

Status: Closed
Owner:
Closed: Aug 20
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::BaselineContext::FindCompatibleSharedGroup

Project Member Reported by ClusterFuzz, Jul 26

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5568082924535808

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::BaselineContext::FindCompatibleSharedGroup
  blink::GridBaselineAlignment::GetBaselineGroupForChild
  blink::GridBaselineAlignment::BaselineOffsetForChild
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=562405:562407

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5568082924535808

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jul 26

Components: Blink>Layout
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jul 26

Labels: Test-Predator-Auto-Owner
Owner: jfernan...@igalia.com
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/6534acd9b94a260ccf88ccdfd7ab8b3859349082 ([css-grid] Baseline alignment inside the tracks sizing algorithm).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Labels: -Pri-1 Pri-2
This is bad and needs to be fixed but it is not a P1.

Wow, I've been fixing several of these kind in the last month; I hoped there were no more at this point. I'll take a look ASAP.
Umm, I'm unable to access to the clusterfuzz detailed report. It claims something about "too many redirects". 

Could anybody attach a reduced test case to reproduce the issue ?
Attached a reduced test case to reproduce the issue.
crash-baseline-algorithm-8.html
367 bytes View Download
An even more reduced test case.
crash-baseline-algorithm-8.html
307 bytes View Download
Components: -Blink>Layout Blink>Layout>Grid
Status: Started (was: Assigned)
See progress in https://crrev.com/c/1177757
Project Member

Comment 10 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 11 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 12 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 13 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 14 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 15 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 16 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 17 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 18 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 19 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 20 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 21 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 22 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 23 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 24 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 25 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 26 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 27 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 28 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Is there any way to stop the spamming in this bug?
Project Member

Comment 30 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 31 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 32 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Project Member

Comment 33 by ClusterFuzz, Aug 20

ClusterFuzz testcase 5568082924535808 is associated with an obsolete fuzzer and can no longer be processed. Please close the issue if it is no longer actionable.
Status: Closed (was: Started)
Let's stop the spam. It's still reproducible, but fortunately, my fix for  issue #874861  will fix this one as well.
Project Member

Comment 36 by bugdroid1@chromium.org, Aug 30

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/48e9d03178ecbf89c5677e08f22ac8c6e366a6ff

commit 48e9d03178ecbf89c5677e08f22ac8c6e366a6ff
Author: Javier Fernandez <jfernandez@igalia.com>
Date: Thu Aug 30 21:56:23 2018

[css-grid] Compute again the baseline offsets during step 3

The new Baseline Alignment algorithm states that items with sizing
cyclic dependencies must be excluded from any baseline context they
participate in. One of these cyclic dependencies can happen with
intrinsic sized grid areas and relative items.

The grid spec states [1] that flex-sized tracks should be considered
as content-sized when the grid container has an indefinite size. We
were using the AvailableSize(direction) function to determine whether
the grid container is indefinite or not. However, this function may
provide different results during the different phases of the grid
layout logic. This issue causes assert violations like the one
described in the bugs listed below.

The new Baseline Alignment logic is now integrated in the Grid Track
sizing algorithm. Hence, we need to ensure that an item that
participates in any baseline alignment context during the track sizing
also does during the alignment phase, at the end of the grid layout
logic. In order to achieve that, this CL forces a new computation of
the Baseline offsets during the step 3 of the Grid sizing algorith,
since during this step the available space is not indefinite anymore.

It's worth mentioning that this change assumes the issue grid items
being excluded and included of Baseline Context during the different
phases of the Grid sizing algorithm, which I hope we can clarify in
the issue [2] I filed for the CSS WG.

[1] https://drafts.csswg.org/css-grid/#fr-unit
[2] https://github.com/w3c/csswg-drafts/issues/3046

Bug:  867833 ,  874861 ,  876593 
Change-Id: I668d399b920c9280a8e20b3e8362f562eded4770
Reviewed-on: https://chromium-review.googlesource.com/1177757
Reviewed-by: Sergio Villar <svillar@igalia.com>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Commit-Queue: Javier Fernandez <jfernandez@igalia.com>
Cr-Commit-Position: refs/heads/master@{#587799}
[modify] https://crrev.com/48e9d03178ecbf89c5677e08f22ac8c6e366a6ff/third_party/WebKit/LayoutTests/external/wpt/css/css-grid/alignment/grid-self-baseline-not-applied-if-sizing-cyclic-dependency-001.html
[modify] https://crrev.com/48e9d03178ecbf89c5677e08f22ac8c6e366a6ff/third_party/WebKit/LayoutTests/external/wpt/css/css-grid/alignment/grid-self-baseline-not-applied-if-sizing-cyclic-dependency-002.html
[add] https://crrev.com/48e9d03178ecbf89c5677e08f22ac8c6e366a6ff/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-self-baseline-and-flex-tracks-with-indefinite-container-crash.html
[modify] https://crrev.com/48e9d03178ecbf89c5677e08f22ac8c6e366a6ff/third_party/blink/renderer/core/layout/grid_track_sizing_algorithm.cc

Sign in to add a comment