Null-dereference READ in blink::JSBasedEventListener::handleEvent |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6294885499666432 Fuzzer: inferno_layout_test_unmodified Job Type: linux_msan_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::JSBasedEventListener::handleEvent blink::EventTarget::FireEventListeners blink::EventTarget::FireEventListeners Sanitizer: memory (MSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=605243:605244 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6294885499666432 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Nov 6
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/183dcec54bb0e630814f54638a0d862da7315029 (Don't dispatch an event in DispatchEventToAOMEventListeners if event's target is null). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Nov 8
,
Nov 9
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/2ed9605b4c99774d8865dbd190e13c9fe5c2d03a commit 2ed9605b4c99774d8865dbd190e13c9fe5c2d03a Author: Hayato Ito <hayato@chromium.org> Date: Fri Nov 09 17:31:43 2018 Fix a bug in https://crrev.com/c/1272937, where event.target can be still null Fix a bug in the previous CL, https://crrev.com/c/1272937, where event.target can be null when GetElement() returns nullptr. Bug: 892970 , 893449 , 902287 Change-Id: I7a08227d39117c2dc90fe720f0d6ffd62d9b2ea6 Reviewed-on: https://chromium-review.googlesource.com/c/1322177 Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org> Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org> Cr-Commit-Position: refs/heads/master@{#606884} [modify] https://crrev.com/2ed9605b4c99774d8865dbd190e13c9fe5c2d03a/third_party/blink/renderer/modules/accessibility/ax_object.cc
,
Nov 10
ClusterFuzz has detected this issue as fixed in range 606873:606888. Detailed report: https://clusterfuzz.com/testcase?key=6294885499666432 Fuzzer: inferno_layout_test_unmodified Job Type: linux_msan_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::JSBasedEventListener::handleEvent blink::EventTarget::FireEventListeners blink::EventTarget::FireEventListeners Sanitizer: memory (MSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=605243:605244 Fixed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=606873:606888 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6294885499666432 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 10
ClusterFuzz testcase 6294885499666432 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Nov 6Labels: Test-Predator-Auto-Components