Null-dereference READ in blink::Document::UpdateStyleAndLayoutIgnorePendingStylesheets |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6692614655705088 Fuzzer: mbarbella_js_mutation_layout Job Type: linux_asan_chrome_mp Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000210 Crash State: blink::Document::UpdateStyleAndLayoutIgnorePendingStylesheets blink::FrameSelection::ComputeVisibleSelectionInDOMTreeDeprecated blink::WebLocalFrameImpl::HasSelection Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=594766:594769 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6692614655705088 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Sep 29
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
Sep 29
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/fe7f8c3cc9889e4a1fd18742691d621982b2c171 (Add UMA and UKM for forced layouts). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Oct 3
This is revealing an existing problem. Apparently the frame_ is non null but bad. Will require more investigation but not a P1.
,
Jan 7
Duplicate of bug 825277?
,
Jan 8
Yes, probably, though I think this is something I really should have written the trivial fix for. So let's leave it.
,
Jan 8
,
Jan 19
(3 days ago)
ClusterFuzz testcase 6239326311284736 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Sep 29