Null-dereference READ in blink::CompositedLayerMapping::UpdateMainGraphicsLayerGeometry |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5112331854675968 Fuzzer: inferno_twister Job Type: linux_ubsan_vptr_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::CompositedLayerMapping::UpdateMainGraphicsLayerGeometry blink::PaintLayerCompositor::UpdateIfNeeded blink::PaintLayerCompositor::UpdateIfNeededRecursiveInternal Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=589268:589272 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5112331854675968 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Sep 7
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/a60db65dec5655f0944484a01bd34573f2292765 (Track layout jank from composited layer movement.). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Sep 7
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/ecca624af2441174fc6c72fd6a23508faa0e87ed commit ecca624af2441174fc6c72fd6a23508faa0e87ed Author: Steve Kobes <skobes@chromium.org> Date: Fri Sep 07 21:11:41 2018 Check for fragment data in JankTracker::NotifyCompositedLayerMoved. If we haven't gone through prepaint since the LayoutObject was attached, we will crash accessing the transform node. Bug: 881921, 881735 , 881643 Change-Id: I3c27c045a87319a3da2f1803707d42139d41cbfd Reviewed-on: https://chromium-review.googlesource.com/1213805 Commit-Queue: Steve Kobes <skobes@chromium.org> Reviewed-by: Timothy Dresser <tdresser@chromium.org> Cr-Commit-Position: refs/heads/master@{#589648} [modify] https://crrev.com/ecca624af2441174fc6c72fd6a23508faa0e87ed/third_party/blink/renderer/core/layout/jank_tracker.cc [modify] https://crrev.com/ecca624af2441174fc6c72fd6a23508faa0e87ed/third_party/blink/renderer/core/layout/jank_tracker_test.cc
,
Sep 8
ClusterFuzz has detected this issue as fixed in range 589628:589650. Detailed report: https://clusterfuzz.com/testcase?key=5112331854675968 Fuzzer: inferno_twister Job Type: linux_ubsan_vptr_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::CompositedLayerMapping::UpdateMainGraphicsLayerGeometry blink::PaintLayerCompositor::UpdateIfNeeded blink::PaintLayerCompositor::UpdateIfNeededRecursiveInternal Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=589268:589272 Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=589628:589650 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5112331854675968 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 8
ClusterFuzz testcase 5112331854675968 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by ClusterFuzz
, Sep 7Labels: Test-Predator-Auto-Components