New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 899430 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Nov 7
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in content::RenderWidgetHostImpl::OnHasTouchEventHandlers

Project Member Reported by ClusterFuzz, Oct 27

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5129834345529344

Fuzzer: inferno_twister
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  content::RenderWidgetHostImpl::OnHasTouchEventHandlers
  bool IPC::MessageT<WidgetHostMsg_HasTouchEventHandlers_Meta, std::__1::tuple<boo
  content::RenderWidgetHostImpl::OnMessageReceived
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=603121:603127

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5129834345529344

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 27

Components: Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: kkaluri@chromium.org
Labels: M-72 Test-Predator-Wrong
Owner: ajwong@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.

Using Code Search for the file, "render_widget_host_impl.cc" suspecting the below Cl might have caused this issue

Suspect CL: https://chromium.googlesource.com/chromium/src/+/eb28e7e34aba87013ba804e64faa214cce5caf94

ajwong@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!
 Issue 899518  has been merged into this issue.
Project Member

Comment 4 by bugdroid1@chromium.org, Nov 6

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3afdf9f845b241c97e3ea678cab3c2a3a89028d8

commit 3afdf9f845b241c97e3ea678cab3c2a3a89028d8
Author: Albert J. Wong <ajwong@chromium.org>
Date: Tue Nov 06 23:30:57 2018

Check RWHI::delegate_ before deferencing.

The existing code null defers for RenderWidgetHosts that do not
have a delegate registered. This occurs at least in some setups
with file pickers and shared workers.

Bug:  899430 
Change-Id: Idfd22c18b06cd968100cfab8d8c5c060f4e42bdb
Reviewed-on: https://chromium-review.googlesource.com/c/1321031
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Commit-Queue: Albert J. Wong <ajwong@chromium.org>
Cr-Commit-Position: refs/heads/master@{#605872}
[modify] https://crrev.com/3afdf9f845b241c97e3ea678cab3c2a3a89028d8/content/browser/renderer_host/render_widget_host_impl.cc

Project Member

Comment 5 by ClusterFuzz, Nov 7

ClusterFuzz has detected this issue as fixed in range 605869:605879.

Detailed report: https://clusterfuzz.com/testcase?key=5129834345529344

Fuzzer: inferno_twister
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  content::RenderWidgetHostImpl::OnHasTouchEventHandlers
  bool IPC::MessageT<WidgetHostMsg_HasTouchEventHandlers_Meta, std::__1::tuple<boo
  content::RenderWidgetHostImpl::OnMessageReceived
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=603121:603127
Fixed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=605869:605879

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5129834345529344

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Nov 7

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5129834345529344 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment