Status Update
No update yet.
Comments
24...@project.gserviceaccount.com
Project: platform/frameworks/support
Branch: androidx-main
Author: Radha Nakade <
Link:
Migrate traffic from pixel2 to mediumphone on FTL emulators.
Expand for full commit details
Migrate traffic from pixel2 to mediumphone on FTL emulators.
Bug: 396715333
Test: ./gradlew emoji2:emoji2-emojipicker:ftlmediumphoneapi33
Change-Id: If5555443ca1a91479128e1bd6f4f909154c40ba2
Files:
- M
buildSrc/private/src/main/kotlin/androidx/build/FtlRunner.kt
Hash: c76f8094154101867327912e659ae47509755957
Date: Wed Feb 26 11:27:46 2025
na...@chromium.org
Using Code Search for the file, “display_media_access_handler.cc” suspecting the below Cl might have caused this issue
Suspect CL :
@Mark Foltz -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.
Thanks!
al...@chromium.org
Mark's change was just a cleanup. Looking at git blame, the relevant CHECK was added:
wt...@google.com
Hmm, the content settings type "DISPLAY_MEDIA_SYSTEM_AUDIO" is designed for WebUI pages only.
So it seems the fuzzer somehow triggers this path with an unexpected URL.
Maybe we can reject the request instead of using a CHECK when it violates the assumption to avoid such crash. [
Pi-Hsun, could you help on the fix?
Thanks.
al...@chromium.org
I think the fuzzer assumes a compromised renderer, so if the renderer is the source of truth for when a DISPLAY_MEDIA_SYSTEM_AUDIO request is sent, that seems reasonable that the fuzzer could trigger it.
Description
Fuzzing Engine: libFuzzer
Fuzz Target: mojo_js_in_process_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux
Crash Type: CHECK failure
Crash Address:
Crash State:
web_contents->GetLastCommittedURL().scheme() == content::kChromeUIScheme in disp
DisplayMediaAccessHandler::BypassMediaSelectionDialog
DisplayMediaAccessHandler::HandleRequest
Sanitizer: address (ASAN)
Regressed:
Reproducer Testcase:
Issue filed automatically.
See