Author: jochen@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/051023a269e548c5da19246c7db6e9870dac2f69
Time: Mon Sep 14 18:02:36 2015
The CL last changed line 126 of file V8DOMWrapper.cpp, which is stack frame 1.

@jochen: Could you please look into this issue.

Thank you.

Daniel, this hits your assert :)

ClusterFuzz has detected this issue as fixed in range 410349:410400.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5714629291933696

Fuzzer: inferno_twister
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  frame()->isRemoteFrame() || !activeOrigin->canAccessCheckSuborigins(targetOrigin
  blink::DOMWindow::crossDomainAccessErrorMessage
  blink::V8WrapperInstantiationScope::convertException
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=348655:348681
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=410349:410400

Minimized Testcase (0.25 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96K1vcss2j5N8j-BnIUNMdZD5AkqxrUux6U9Elf3cDsYIBS01iNl20AuqV_X9Iqbx1GaAzAZAMX02yJ-l3BF8_7b5Ls5GJLfoA3AX9woeTC9SpXk08_AGLwhdYaHDJ-nL3PUB0_1OGO4fl7UxJ76W9U0P7SMw?testcase_id=5714629291933696
 list-style-position: outside;<script>
var iframe = document.body.appendChild(document.createElement("iframe"));
    var win = iframe.contentWindow;
    function recurse() {
        try { recurse(); } catch(e) {}
 win.location; 
    }
    recurse();
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

FWIW I'm a bit suspicious of clusterfuzz's methodology here. I don't see anything in the fixed range that suggests it would have affected this behavior...

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot