Issue metadata
Sign in to add a comment
|
Null-dereference READ in blink::PropertyTreeManager::SynthesizeCcEffectsForClipsIfNeeded |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5745432091951104 Fuzzer: ochang_domfuzzer Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000008 Crash State: blink::PropertyTreeManager::SynthesizeCcEffectsForClipsIfNeeded blink::PropertyTreeManager::BuildEffectNodesRecursively blink::PropertyTreeManager::BuildEffectNodesRecursively Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=602149:602151 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5745432091951104 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Oct 24
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/4e8eb7fbb5ada77093c526013db61d2c438ca24d ([BlinkGenPropertyTrees] Promote BGPT to experimental). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Oct 24
Minimized testcase:
<!doctype html>
<style>
body {
overflow: -webkit-paged-x;
clip-path: circle(40%);
}
div {
will-change: transform;
}
</style>
<body>
<div></div>
</body>
Work in progress: https://chromium-review.googlesource.com/c/chromium/src/+/1298239
,
Oct 26
This turned out to be another instance of https://crbug.com/803649
,
Oct 30
ClusterFuzz has detected this issue as fixed in range 603709:603710. Detailed report: https://clusterfuzz.com/testcase?key=5745432091951104 Fuzzer: ochang_domfuzzer Job Type: linux_asan_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000008 Crash State: blink::PropertyTreeManager::SynthesizeCcEffectsForClipsIfNeeded blink::PropertyTreeManager::BuildEffectNodesRecursively blink::PropertyTreeManager::BuildEffectNodesRecursively Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=602149:602151 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=603709:603710 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5745432091951104 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Oct 24Labels: Test-Predator-Auto-Components