Null-dereference READ in 'InsertOrderedList' command with unusual HTML |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5695646009655296 Fuzzer: bj_broddelwerk Job Type: mac_asan_chrome Platform Id: mac Crash Type: Null-dereference READ Crash Address: 0x000000000010 Crash State: blink::Node::IsDescendantOf blink::SelectionForParagraphIteration blink::InsertListCommand::DoApply Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=575972:575977 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5695646009655296 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Sep 13
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/7bd29404a6ab8d36bdff4123ae522fcd9068344b ([Blink] Avoid crossing editing boundaries selection.). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Sep 13
From the spec [1], <rtc> should be a child of a <ruby> element, the test case indicates that Blink didn't enforce that; from MDN, Blink doesn't support <rtc> yet, not sure what's the progress in Blink though. In [2], end_of_selection(new_selection.VisibleEnd()) is null even new_selection.End() is a valid position. See new_selection.ShowTreeForThis() below: BODY (editable) S TABLE (editable) #text "\n" #text "\n" RTC (editable) #text "\n" E RT #text "\n" RUBY (editable) #text "\n" #text "\n" RUBY (editable) start: offsetInAnchor[0] end: offsetInAnchor[0] Probably not related to my CL, xiaochengh@, yosin@, could you have a look, thanks! [1] https://www.w3.org/TR/html52/textlevel-semantics.html#the-rtc-element [2] https://chromium.googlesource.com/chromium/src/+/bc9185c627f678ff37431b6e9e112f72cabe0f4d/third_party/blink/renderer/core/editing/commands/editing_commands_utilities.cc#447
,
Sep 18
P3 due to low usage of InsertOrderedList command and unusual HTML.
,
Oct 10
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Sep 13Labels: Test-Predator-Auto-Components