DragController::DispatchTextInputEventFor() should check whether event target is not null |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6295388314927104 Fuzzer: ochang_domfuzzer Job Type: linux_msan_content_shell_drt Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: blink::EventTarget::DispatchEvent blink::DragController::DispatchTextInputEventFor blink::DragController::ConcludeEditDrag Sanitizer: memory (MSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=602389:602396 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6295388314927104 Issue filed automatically. See https://www.chromium.org/developers/testing/memorysanitizer#TOC-Reproducing-ClusterFuzz-Bugs for instructions to reproduce this bug locally.
,
Dec 28
Predator and CL could not provide any possible suspects. Using the code search for the file, “event_target.cc” assigning to concern owner from GIT revision log. Suspecting Commit# https://chromium.googlesource.com/chromium/src/+/6a0529ac33f137fa3e850218415f5bda31dbaa88 @hayato -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes. Thank You.
,
Jan 7
,
Jan 18
(4 days ago)
yosin@, it looks related to editing.
,
Yesterday
(47 hours ago)
|target| in DragController::DispatchTextInputEventFor() is null for test script.
|target| is computed as:
Element* target = FindEventTargetFrom(
*inner_frame,
CreateVisibleSelection(
SelectionInDOMTree::Builder().Collapse(caret_position).Build()));
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Dec 22Labels: Test-Predator-Auto-Components