Suspected CLs	The result is a list of CLs that change the crashed files.

Author: danakj
Component: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/725e6226b8714431519d92b7d41cf0a90f2a93a5
Time: Mon Feb 29 22:06:50 2016
Files CompositedLayerMapping.cpp, CompositingLayerAssigner.cpp are changed in this cl (and is part of stack frame #1, "chrome_child!blink::CompositedLayerMapping::updateScrollingLayers+0x115 "; frame #2, "chrome_child!blink::CompositedLayerMapping::~CompositedLayerMapping+0x1f3")
Minimum distance from crash line to modified line: 4. (file: CompositingLayerAssigner.cpp, crashed on: 261, modified: 257).

Suspected Component: chromium
Suspected Cr- Label: Cr-Blink-Compositing

Why is this assigned to me for a CL titled "Rename enums/functions that collide in chromium style in WTF::HashMap"? Renaming a function does not cause crashes.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4936331806900224

Fuzzer: marty_html_twiddler
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000003
Crash State:
  blink::ScrollingCoordinator::scrollableAreaScrollLayerDidChange
  blink::CompositedLayerMapping::~CompositedLayerMapping
  blink::PaintLayer::~PaintLayer
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=378578:378682

Minimized Testcase (2.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv972KyhPHr9y8xCEpD1JEbETN1zENeV8gzCBpncmN6HeRYVowuxMs6WOkQTGGQVD26M02C6Wsr3w3MPcoRVK1bX6tn2Z7TGCmuGxECD5fZejloFXOhcbmUcRyS0vEADXV_pGvVFgI7iMmoClVmWM42urxMpmAw

Filer: ranjitkan

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5109654541041664

Fuzzer: marty_html_twiddler
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000003
Crash State:
  blink::ScrollingCoordinator::scrollableAreaScrollLayerDidChange
  blink::CompositedLayerMapping::~CompositedLayerMapping
  blink::PaintLayer::clearCompositedLayerMapping
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=378207:378422

Minimized Testcase (0.53 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94LIJB4f-WbJIhkU0S9tZIHedpTV8upZT7rQTiU_YzqbhwBzQ2MKdYA-OIr9vCMv6vxZBqGjCBFemsJuH75cdyyHIPwkLO1Xvlv5OEgIJLSPlf2sUPyC92Mt0CZLvlBwQaN5Ade0y9X6WGaJek1jqMtpFc-lg
<style>
.c4[class$="c4"] { overflow: inherit; -webkit-column-count: 2; }
.c6 { overflow: auto; height: 0px; -webkit-transform: rotate3d(1, 0, 0, 45deg);</style>
<script>
var nodes = Array();
 nodes[30] = document.createElement('hgroup'); 
 nodes[30].setAttribute('class', 'c6'); 
 document.documentElement.appendChild(nodes[30]); 
 nodes[44] = document.createElement('br'); 
setTimeout('try { nodes[30].appendChild(nodes[44]); } catch(e) {}');
setTimeout("try { nodes[30].setAttribute('class', 'c4'); } catch(e) {}", 436);
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Accessing a GCed object from ~CompositedLayerMapping might be unsafe, needs to be clarified.

Any lifetime issues wrt GCed objects doesn't appear to be it; m_owningLayer's ScrollableArea is missing when accessed in updateScrollingLayers().

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4936331806900224

Fuzzer: marty_html_twiddler
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000003
Crash State:
  blink::ScrollingCoordinator::scrollableAreaScrollLayerDidChange
  blink::CompositedLayerMapping::~CompositedLayerMapping
  blink::PaintLayer::~PaintLayer
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=378578:378682

Minimized Testcase (2.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv972KyhPHr9y8xCEpD1JEbETN1zENeV8gzCBpncmN6HeRYVowuxMs6WOkQTGGQVD26M02C6Wsr3w3MPcoRVK1bX6tn2Z7TGCmuGxECD5fZejloFXOhcbmUcRyS0vEADXV_pGvVFgI7iMmoClVmWM42urxMpmAw

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Looping in chromium//src/third_party/WebKit/Source/core/layout/OWNERS as i am unable to find any recent changes in the code search.

@dsinclair, can you please assign this bug accordingly ?

chrishtr@ is this a paint issue?

I think this was caused by Xianzhu's patch. (which was reverted)

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot