Null-dereference READ in ash::LockContentsView::OnFocusLeavingSystemTray |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4776625788682240 Fuzzer: phoglund_webrtc_peerconnection Job Type: linux_asan_chrome_chromeos Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: ash::LockContentsView::OnFocusLeavingSystemTray ash::SystemTrayNotifier::NotifyFocusOut ash::LoginShelfView::AboutToRequestFocusFromTabTraversal Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=613359:613372 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4776625788682240 Additional requirements: Requires Gestures Additional requirements: Requires HTTP Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Dec 12
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/6b73dc9fad128a353cf2ea70920fc0bd66a888be (Fix escaping focus traversal from LoginUserMenu). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Dec 17
qnnguyen@ is this something you could help take a look at? I couldn't get this to repro reliably but was able to hit this twice: [175348:175348:1217/221740.890848:FATAL:focus_search.cc(89)] Check failed: IsFocusable(v). #0 0x7f1c2f480dbd base::debug::StackTrace::StackTrace() #1 0x7f1c2f17b5ea base::debug::StackTrace::StackTrace() #2 0x7f1c2f1e775e logging::LogMessage::~LogMessage() #3 0x7f1c19c0c6e7 views::FocusSearch::FindNextFocusableView() #4 0x7f1c16658494 ash::(anonymous namespace)::FindFirstOrLastFocusableChild() #5 0x7f1c1665857f ash::LockContentsView::OnFocusLeavingSystemTray() #6 0x7f1c1695a756 ash::SystemTrayNotifier::NotifyFocusOut() #7 0x7f1c16772a84 ash::LoginShelfView::AboutToRequestFocusFromTabTraversal() #8 0x7f1c19c07c33 views::FocusManager::AdvanceFocus() It looks to me like this IsFocusable check can fail if v is nullptr.
,
Jan 3
qnnguyen@ said they could try taking a look :) |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Dec 12Labels: Test-Predator-Auto-Components