Pointer-overflow in blink::FindBuffer::MappingForIndex |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4625366997794816 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Pointer-overflow Crash Address: Crash State: blink::FindBuffer::MappingForIndex blink::FindBuffer::PositionAtStartOfCharacterAtIndex blink::FindBuffer::RangeFromBufferIndex Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=616895:616898 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4625366997794816 Additional requirements: Requires Gestures Issue filed automatically. See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.
,
Dec 16
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/0be1119f808d95d053e7368aa3352b7de29ecc87 (Reland "Find-in-page per block using FindBuffer"). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Dec 17
Hmm, I can't reproduce it locally. The minimized testcase is just "<body> <style>" and I also tried doing the interactions listed (well, just moving around the mouse and clicking the keys)
,
Dec 17
|
|||
►
Sign in to add a comment |
|||
Comment 1 by ClusterFuzz
, Dec 16Labels: Test-Predator-Auto-Components