New issue
Advanced search Search tips

Issue 869839 link

Starred by 1 user
Status: WontFix
Owner: ----
Closed: Aug 1
Cc:
danakj@chromium.org
ifratric@google.com
jbroman@chromium.org
bokan@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Float-cast-overflow in blink::LayoutBox::AbsoluteContentBox

Project Member Reported by ClusterFuzz, Aug 1 
Detailed report: https://clusterfuzz.com/testcase?key=6191321870761984

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::LayoutBox::AbsoluteContentBox
  blink::LayoutBox::ComputeResourcePriority
  blink::PriorityFromObserver
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=551565:563900

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6191321870761984

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
Project Member

Comment 1 by ClusterFuzz, Aug 1

Components: Blink>Layout Blink>Loader
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Aug 1

Cc: danakj@chromium.org bokan@chromium.org jbroman@chromium.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Remove WebBlendMode from WebLayer API, use SkBlendMode directly. by danakj@chromium.org - https://chromium.googlesource.com/chromium/src/+/b68698e6c0c71af8f3b667ad547fc9d7ca2d1ef3

Replace uses of WTF::AutoReset with base::AutoReset. by jbroman@chromium.org - https://chromium.googlesource.com/chromium/src/+/7dc0ff470efdfb2f27f3e43b909f0839f4542a8f

Correct OverflowClipRect() for root scroller by bokan@chromium.org - https://chromium.googlesource.com/chromium/src/+/8c76d1277b168775e75f53c06c7b9bde185fe276

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.

Comment 3 by bokan@chromium.org, Aug 1

Status: WontFix (was: Untriaged)
The running policy is to WontFix non-security overflow issues.
Project Member

Comment 4 by ClusterFuzz, Aug 8

Labels: Needs-Feedback
ClusterFuzz testcase 6191321870761984 is still reproducing on tip-of-tree build (trunk).

If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase.

Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
►

Sign in to add a comment