New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 913149 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Dec 14
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug

Blocking:
issue 862460



Sign in to add a comment

While parsing feature policy feature it crashes in BitVector::QuickGet() on Win7

Project Member Reported by mrunal.k...@intel.com, Dec 8

Issue description

What steps will reproduce the problem?
(1) As I add feature policy feature, Wake lock[1] at 31st position I seem to be encountering crash on Windows 7 try bots[2] with following error[3],
19:58:38.258 7156 worker/1 external/wpt/wake-lock/wakelock-disabled-by-feature-policy.https.sub.html crashed, (stderr lines):
298.8s
 19:58:38.258 7156 [7888:1664:1127/195837.454:FATAL:bit_vector.h(104)] Security CHECK failed: bit < size().
 298.8s
 19:58:38.258 7156 Backtrace:
298.8s
 19:58:38.258 7156 base::debug::StackTrace::StackTrace [0x02290220+32]
298.8s
 19:58:38.258 7156 base::debug::StackTrace::StackTrace [0x0228F99D+13]
298.8s
 19:58:38.258 7156 logging::LogMessage::~LogMessage [0x022A5950+96]
298.8s
 19:58:38.258 7156 WTF::BitVector::QuickGet [0x029FE8A7+111]
298.8s
 19:58:38.258 7156 blink::ParseFeaturePolicy [0x033490CA+753]
298.8s
 19:58:38.258 7156 blink::ParseFeaturePolicyHeader [0x03348DB1+101]
298.8s
 19:58:38.258 7156 blink::Document::ApplyFeaturePolicyFromHeader [0x029884CF+117]
Other platforms don't seem to have this sort of crash including Windows 10.
(2) I don't have Windows 7 system to reproduce this issue but while testing it on 64-bit Linux I saw that max size() was 63 there which also very small max size to have for max numbers of feature policy features. 

What is the expected result?
BitVector size should be significantly larger to accomodate decently large numbers of feature policy features. Also all platforms should exhibit same max numbers of Feature Policy features which you can add.

What happens instead?
While parsing feature policy feature at 31st position it fails the security check in the BitVector::QuickGet() function.


[1] https://chromium-review.googlesource.com/c/chromium/src/+/1343193/2
[2] https://ci.chromium.org/p/chromium/builders/luci.chromium.try/win7_chromium_rel_ng/139319
[3] https://logs.chromium.org/logs/chromium/buildbucket/cr-buildbucket.appspot.com/8928647343531410048/+/steps/webkit_layout_tests__with_patch_/0/stdout



 
Blocking: 862460
Cc: -iclell...@chromium.org
Owner: iclell...@chromium.org
Status: Assigned (was: Untriaged)
I found the source of the failure and commented on the bug.
Status: Fixed (was: Assigned)
Thank you Yuta. I think changes suggested by you should fix the issue long term. So marking this fixed for now.

Sign in to add a comment