This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Can't reproduce this on my 'Sunday' build. Morten has done some recent work on mergeContiguousAnonymousBlocks() which might have triggered this crash all of a sudden. I can take a look tomorrow if it's definitely mine.

Need to pwn this bug in order to get access the fuzzer report.

Hey, the fuzzer run is timestamped 2016-03-26 05:22:34? That's a long time ago. This certainly doesn't have anything to do with my recent changes, then. Could we trigger a rerun with a newer build or something?

Also: cannot reproduce with my fairly recent build.

ClusterFuzz has detected this issue as fixed in range 384695:385240.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4649062162235392

Fuzzer: bj_broddelwerk
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Heap-use-after-free READ 7
Crash Address: 0x6110002766b8
Crash State:
  blink::LayoutObject::isAnonymousBlock
  blink::LayoutListItem::updateMarkerLocation
  blink::LayoutListItem::subtreeDidChange
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=381067:381276
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=384695:385240

Minimized Testcase (0.87 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94eeymR60P7GYNKXuF1rL9EYpgmBA4cfAUw9ApS0DSDH_e1ZEvmjZxXBB6OWlC9pNWBjQJZSiRDUM6TlbaLcLMbNKwbF5byZp_PpsesnHgHfDlO4PPYAF79jl6bZAZLg9DY3djhYHgEsUtkmiQ0CFy584eWfQ

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Good - thanks. :)

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot