Null-dereference READ in content::RenderWidgetHostImpl::OnHasTouchEventHandlers |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5129834345529344 Fuzzer: inferno_twister Job Type: linux_msan_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: content::RenderWidgetHostImpl::OnHasTouchEventHandlers bool IPC::MessageT<WidgetHostMsg_HasTouchEventHandlers_Meta, std::__1::tuple<boo content::RenderWidgetHostImpl::OnMessageReceived Sanitizer: memory (MSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=603121:603127 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5129834345529344 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Oct 29
Predator and CL could not provide any possible suspects. Using Code Search for the file, "render_widget_host_impl.cc" suspecting the below Cl might have caused this issue Suspect CL: https://chromium.googlesource.com/chromium/src/+/eb28e7e34aba87013ba804e64faa214cce5caf94 ajwong@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner. Thanks!
,
Oct 29
Issue 899518 has been merged into this issue.
,
Nov 6
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/3afdf9f845b241c97e3ea678cab3c2a3a89028d8 commit 3afdf9f845b241c97e3ea678cab3c2a3a89028d8 Author: Albert J. Wong <ajwong@chromium.org> Date: Tue Nov 06 23:30:57 2018 Check RWHI::delegate_ before deferencing. The existing code null defers for RenderWidgetHosts that do not have a delegate registered. This occurs at least in some setups with file pickers and shared workers. Bug: 899430 Change-Id: Idfd22c18b06cd968100cfab8d8c5c060f4e42bdb Reviewed-on: https://chromium-review.googlesource.com/c/1321031 Reviewed-by: Nasko Oskov <nasko@chromium.org> Commit-Queue: Albert J. Wong <ajwong@chromium.org> Cr-Commit-Position: refs/heads/master@{#605872} [modify] https://crrev.com/3afdf9f845b241c97e3ea678cab3c2a3a89028d8/content/browser/renderer_host/render_widget_host_impl.cc
,
Nov 7
ClusterFuzz has detected this issue as fixed in range 605869:605879. Detailed report: https://clusterfuzz.com/testcase?key=5129834345529344 Fuzzer: inferno_twister Job Type: linux_msan_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: content::RenderWidgetHostImpl::OnHasTouchEventHandlers bool IPC::MessageT<WidgetHostMsg_HasTouchEventHandlers_Meta, std::__1::tuple<boo content::RenderWidgetHostImpl::OnMessageReceived Sanitizer: memory (MSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=603121:603127 Fixed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=605869:605879 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5129834345529344 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 7
ClusterFuzz testcase 5129834345529344 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by ClusterFuzz
, Oct 27Labels: Test-Predator-Auto-Components