Null-dereference WRITE in blink::PresentationController::SetPresentation |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4669442922119168 Fuzzer: ochang_domfuzzer Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: Null-dereference WRITE Crash Address: 0x000000000040 Crash State: blink::PresentationController::SetPresentation blink::Presentation::Create blink::NavigatorPresentation::presentation Sanitizer: address (ASAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4669442922119168 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Sep 26
More detail here: no supplements are being installed because the popup page has PagePopupChromeClient, which has an empty implementation of InstallSupplements. This only matters if we can access the popup page (or we start making the popup page use the presentation API or a handful of others), which isn't possible but for window.internals. Let me see if this is easy to fix; if not, I'll just WontFix this too.
,
Sep 26
Not easy to just have it run all of the initializers, because some depend on a non-trivial LocalFrameClient being used, but we have EmptyLocalFrameClient for popups.
,
Sep 26
Tried to just make PresentationController lazily created, since it doesn't seem to benefit from eager creation. This just kicks the can down to StorageNamespaceController. It'd probably be possible to chase these all down, but it doesn't really seem worthwhile. Wontfix-ing, again.
,
Oct 3
ClusterFuzz testcase 4669442922119168 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
,
Oct 4
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by kkaluri@chromium.org
, Sep 26Labels: Test-Predator-Wrong M-70
Owner: jbroman@chromium.org
Status: Assigned (was: Untriaged)