Issue metadata
Sign in to add a comment
|
Stack-overflow in blink::PaintLayer::MarkCompositingContainerChainForNeedsRepaint |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6196286198644736 Fuzzer: inferno_twister Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: Stack-overflow Crash Address: 0x7ffe0fc7fff8 Crash State: blink::PaintLayer::MarkCompositingContainerChainForNeedsRepaint Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=571663:571669 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6196286198644736 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Sep 4
Predator and CL could not provide any possible suspects. Using the code search for the file, “paint_layer.cc” assigning to owner concerned from GIT blame. Suspecting Commit# https://chromium.googlesource.com/chromium/src/+/af3e961ab018262a08de4b9c73e1ddeefce7160f @wangxianzhu -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes. Thank You.
,
Sep 4
Comment 3 and 4 were for another bug, mistakenly added in this bug.
,
Sep 4
The test creates a dom tree with a depth of 3000 levels. Based on my debugging, the functions that are recursively called don't have infinite recursion, and the stack frame size is small. Even if the stack didn't overflow in paint_layer.cc, it would still overflow in other stages of the pipleline. In addition, the stack overflow occurs in an asan build only. I tracked the stack frame size. In an asan build, the distances of stack pointers between each two function calls are much bigger than those in a normal build.
,
Jan 3
ClusterFuzz has detected this issue as fixed in range 619628:619629. Detailed report: https://clusterfuzz.com/testcase?key=6196286198644736 Fuzzer: inferno_twister Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: Stack-overflow Crash Address: 0x7ffe0fc7fff8 Crash State: blink::PaintLayer::MarkCompositingContainerChainForNeedsRepaint Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=571663:571669 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=619628:619629 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6196286198644736 See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Sep 3Labels: Test-Predator-Auto-Components