[Webkit-unassigned] [Bug 43041] New: cross_fuzz WTF::Vector<...>::reserveCapacity DebugBreak (e59d9e1bc9ba856e181342fbfc4517c9)
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Tue Jul 27 04:31:48 PDT 2010
https://bugs.webkit.org/show_bug.cgi?id=43041
Summary: cross_fuzz WTF::Vector<...>::reserveCapacity
DebugBreak (e59d9e1bc9ba856e181342fbfc4517c9)
Product: WebKit
Version: 528+ (Nightly build)
Platform: PC
URL: http://code.google.com/p/chromium/issues/detail?id=502
06
OS/Version: Windows Vista
Status: NEW
Severity: Normal
Priority: P1
Component: HTML DOM
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: skylined at chromium.org
CC: eric at webkit.org
Blocks: 43040
Created an attachment (id=62680)
--> (https://bugs.webkit.org/attachment.cgi?id=62680)
Details
A new fuzzer by lcamtuf described in bug 43040 produced the attached crash. We have no repro for now. Initial analysis of the attached info indicates a request for a large amount of memory leads to OOM and the code triggers a DebugBreak to terminate the renderer. If somebody can confirm this is what happened from the attached data, then this bug can probably be closed as "Won't Fix".
Otherwise, we'll have to find a repro or analyze possible code paths to find out what happened.
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list