Issue 612920 has been merged into this issue.

The CF testcase is marked as "Unreproducible", but running that testcase locally gives me a null deref with a similar stack.

pennymac, friendly ping - was any progress made here? bug 612922 (which is owned by tsepez@) might be related.

I'll take this, similar to the related bug.  Repro's with a segv in pdfium_test on linux.

At https://code.google.com/p/chromium/codesearch#chromium/src/third_party/pdfium/xfa/fxjse/util_inline.h&rcl=1464117624&l=22, we use the presence of an internal field to tell if this is a FXJSE object, but that isn't sufficient. I'm guessing this is being applied to the wrong object type.

Jochen, I recall you took a look at this at one point?  Thoughts

Note that the lpClass argument to FXJSE_RetrieveObjectBinding() is always null, which means that the secondary check at line 40 never happens.

 Issue 615381  has been merged into this issue.

would be rad if clusterfuzz included the JS in plain text for pdf fuzzers...

This might because the interceptor uses the "This()" value, while the actual object that has the intereptor on it is the Holder() value. The XFA code is ridiculously bad :-/

https://pdfium.googlesource.com/pdfium/+/3a005f22703b9303a306bf34cbd17c3729f763aa may take care of this.

 Issue 615792  has been merged into this issue.

Adding Merge-Triage label for tracking purposes.

Once your fix had sufficient bake time (on canary, dev as appropriate), please nominate your fix for merge by adding the Merge-Request-XX label, where XX is the Chrome milestone.

When your merge is approved by the release manager, please start merging with higher milestone label first. Make sure to re-request merge for every milestone in the label list. You can get branch information on omahaproxy.appspot.com.

- Your friendly ClusterFuzz

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0191740cd56ba9de20ca1add6964d6b9023fd555

commit 0191740cd56ba9de20ca1add6964d6b9023fd555
Author: ochang <ochang@chromium.org>
Date: Thu Jun 02 05:46:03 2016

Roll PDFium d23df55..c324646

https://pdfium.googlesource.com/pdfium.git/+log/d23df55..c324646

BUG= 616248 , 427616 , 613623 , 616246 , 613607 
TBR=thestig@chromium.org

Review-Url: https://codereview.chromium.org/2034443002
Cr-Commit-Position: refs/heads/master@{#397297}

[modify] https://crrev.com/0191740cd56ba9de20ca1add6964d6b9023fd555/DEPS

ochang: Didn't we turn off XFA for M-52?

[Automated comment] DEPS changes referenced in bugdroid comments, needs manual review.

Yep. It should be turned off -- removing request labels.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot