Issue 962029 in chromium: Security DCHECK failure: offset + length <= impl.length() in string_view.h

[ClusterFuzz via monorail]

Updates:
Components: Blink>Editing
Labels: Test-Predator-Auto-Components

Comment #1 on issue 962029 by ClusterFuzz: Security DCHECK failure: offset + length <= impl.length() in string_view.h
https://bugs.chromium.org/p/chromium/issues/detail?id=962029#c1

Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

--
You received this message because:
1. A rule CC'd you on the issue
2. You are auto-CC'd on all issues in component Blink>Editing

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings

Reply to this email to add a comment or make updates.

[sheriffbot via monorail]

Updates:
Labels: ReleaseBlock-Stable

Comment #3 on issue 962029 by sheri...@chromium.org: Security DCHECK failure: offset + length <= impl.length() in string_view.h
https://bugs.chromium.org/p/chromium/issues/detail?id=962029#c3

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

[vakh via monorail]

Updates:
Cc: platform-arc...@chromium.org
Components: Blink>Internals>WTF
Owner: yu...@chromium.org
Status: Assigned

Comment #5 on issue 962029 by va...@chromium.org: Security DCHECK failure: offset + length <= impl.length() in string_view.h
https://bugs.chromium.org/p/chromium/issues/detail?id=962029#c5

(No comment was entered for this change.)

[palmer via monorail]

Comment #6 on issue 962029 by pal...@google.com: Security DCHECK failure: offset + length <= impl.length() in string_view.h
https://bugs.chromium.org/p/chromium/issues/detail?id=962029#c6

It seems to me like these should be production CHECKs or branches, not (or, not only) SECURITY_DCHECKs. The values are not known at programming time, they are determined at run-time.

[palmer via monorail]

Updates:
Cc: -platform-arc...@chromium.org

Comment #7 on issue 962029 by pal...@chromium.org: Security DCHECK failure: offset + length <= impl.length() in string_view.h
https://bugs.chromium.org/p/chromium/issues/detail?id=962029#c7

(No comment was entered for this change.)

[yutak via monorail]

Updates:
Components: -Blink>Internals>WTF
Owner: ----
Status: Available

Comment #8 on issue 962029 by yu...@chromium.org: Security DCHECK failure: offset + length <= impl.length() in string_view.h
https://bugs.chromium.org/p/chromium/issues/detail?id=962029#c8

Find someone in editing for this (I'm not working on editing). This shouldn't be a bug of WTF.

To me, this looks less urgent because this is triggered by DeprecatedDumpFrameTreeAsText which shouldn't be callable by JavaScript.