Null-dereference READ in blink::Canvas2DLayerBridge::Hibernate |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4633759698386944 Fuzzer: inferno_canvas_wrecker Job Type: linux_ubsan_vptr_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::Canvas2DLayerBridge::Hibernate base::internal::Invoker<base::internal::BindState<void blink::scheduler::MainThreadSchedulerImpl::RunIdleTask Sanitizer: undefined (UBSAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4633759698386944 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information. Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
,
Sep 4
,
Sep 5
Predator and CL could not provide any possible suspects. Using Code Search for the file, "canvas_2d_layer_bridge.cc" suspecting the below Cl might have caused this issue Suspect CL: https://chromium.googlesource.com/chromium/src/+/b34b7be96c8e4026ab5f17598b4c0682b70b532f mcasas@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner. Thanks!
,
Sep 5
Hmm my CL tried to fix a null-dereference read with a similar signature, tracked in Issue 870873 (so probably it was still there). |
|||
►
Sign in to add a comment |
|||
Comment 1 by ClusterFuzz
, Sep 4Labels: Test-Predator-Auto-Components