Suspected CLs	No CL in the regression range changes the crashed files. The result is the blame information.

Author: ben@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/2374d1813659c2420eda25c884c5f943b292a64d
Time: Tue Mar 04 03:42:27 2014
The CL last changed line 134 of file window.h, which is stack frame 0.

Author: ben@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/2374d1813659c2420eda25c884c5f943b292a64d
Time: Tue Mar 04 03:42:27 2014
The CL last changed line 217 of file window.cc, which is stack frame 1.

Author: ben@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/bf9cdb36cc79becab099c9f37eb80284fb203f45
Time: Fri Oct 25 19:22:45 2013
The CL last changed line 29 of file window_tree_client.cc, which is stack frame 2.

Author: ben@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/e3225e03e88436787f9e215a24ff5e1d70eeeb65
Time: Wed Oct 23 20:44:37 2013
The CL last changed line 43 of file window_tree_client.cc, which is stack frame 3.

Author: ben@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/e3225e03e88436787f9e215a24ff5e1d70eeeb65
Time: Wed Oct 23 20:44:37 2013
The CL last changed line 159 of file native_widget_aura.cc, which is stack frame 4.

Author: wez@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/84ad47e975cb77a12881dc0c72053a22993950ca
Time: Mon Nov 21 18:17:35 2011
The CL last changed line 339 of file widget.cc, which is stack frame 5.

Author: estade
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/4c499dc1bed6d263ffd30dff5e9abab76ffc6094
Time: Tue Mar 01 20:16:31 2016
The CL last changed line 43 of file bubble_dialog_delegate.cc, which is stack frame 6.

Suspected Project: chromium
Suspected Component: Internals>Aura


None of the CLs from the above FindIt result looks related.

Based on the regression range from C#0, suspecting: https://codereview.chromium.org/2024993002

sky@: Could you please take a look at this.

Thank you!

ajha, how sure are we this is new? None of the cls seem relevant to me.

I can't tell, is the crash linux or chromeos. Thanks!

My suspicion is this is timing related, and the aura::Window associated with the RWHVA is no longer in a RootWindow.

ClusterFuzz has detected this issue as fixed in range 398017:398351.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5419103900925952

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000080
Crash State:
  aura::Window::GetRootWindow
  aura::client::ParentWindowWithContext
  views::NativeWidgetAura::InitNativeWidget
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=396897:396922
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=398017:398351

Minimized Testcase (19.45 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96vrznVlIkA-BK152iVJy7amyP7-k6ITVDjPhUgxDnEN0_g1ij-fmudh_TXdaIZecPgoUq9VGox6YXG0sgizGvG33q4qDXolE9RnSjkTdPigHhHT5nIVL-F-cHcmJUKzZ9qfxeuQQMB4axPOdbKP9sze4s6vfr58hj4xecJaeXQBL95PF0

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

I suspect this isn't really fixed. But closing out given fuzzer says fixed.

Re-Opening this as Clusterfuzz has detested this failure and impacting to the Head. Clusterfuzz updates are in below comment.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6385497907920896

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000080
Crash State:
  aura::Window::GetRootWindow
  aura::client::ParentWindowWithContext
  views::NativeWidgetAura::InitNativeWidget
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=209699:209703

Minimized Testcase (19.72 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96nmUmWsFTFyrW7j1qDYaHtBYIA4xuGvUq9P8YQFD__d9YKvyzWBQ8o7h9xA2Xg5l-v25S926JCbWPYF9YcmC7wi737QDHKmudqbPgL3WY6GnYdEItGZc63D5ZGDzweHV9Yai3zkBBVvzjVCMWKWnCQjB-hXIfw-AuPffvpjhFLzUzjmKU

Filer: durga.behera

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5799131625029632

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000048
Crash State:
  aura::Window::GetRootWindow
  aura::Window::GetRootWindow
  aura::client::ParentWindowWithContext
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=397536:397683

Minimized Testcase (103.15 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95xdSQ7WVCE9H_oqiTT-w5nB_IZprfEU1wludmYWJEUCGsj0UhbZ8g6bxvOWPxRHc8Q0apmsQwU_AROgop1TS9bV1o_V28V81KCrnaiqc99GgLIrCchlE7rcLtFzWtpGMnT4uZYP8Fgxb_LCOTRryKdabHvEX_aPWa9SoCKNXjzFZoJa98

Filer: durga.behera

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this issue as fixed in range 398017:398351.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6385497907920896

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000080
Crash State:
  aura::Window::GetRootWindow
  aura::client::ParentWindowWithContext
  views::NativeWidgetAura::InitNativeWidget
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=209699:209703
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=398017:398351

Minimized Testcase (19.72 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96nmUmWsFTFyrW7j1qDYaHtBYIA4xuGvUq9P8YQFD__d9YKvyzWBQ8o7h9xA2Xg5l-v25S926JCbWPYF9YcmC7wi737QDHKmudqbPgL3WY6GnYdEItGZc63D5ZGDzweHV9Yai3zkBBVvzjVCMWKWnCQjB-hXIfw-AuPffvpjhFLzUzjmKU

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6064156893773824

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000080
Crash State:
  aura::Window::GetRootWindow
  aura::client::ParentWindowWithContext
  views::NativeWidgetAura::InitNativeWidget
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=209699:209703

Minimized Testcase (19.61 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95VCE5cEUcwn3g8KecBYdhPZbtqAf-XGmg-DFI2dbWNXIfuEPIqQDVgsyFmrrPVUN4zJlAh7Izxq7uQKdiZ-nh-AyXxYRGPKLZkZX43-TCUeG1pVS7xlLmVwb4PSEgVS27y5nqe-brjtnMKnwRJ94MQe6r5X5f7OOm3T2YvCISLxGrcN78

Filer: durga.behera

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

As per the above comments # 4 and # 9 this is fixed on June 7, but Clusterfuzz still detecting this failure(comment # 8 and # 10).
sky@ : Could you please take a look into this and update further.

ClusterFuzz has detected this issue as fixed in range 398017:398351.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6064156893773824

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000080
Crash State:
  aura::Window::GetRootWindow
  aura::client::ParentWindowWithContext
  views::NativeWidgetAura::InitNativeWidget
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=209699:209703
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=398017:398351

Minimized Testcase (19.61 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95VCE5cEUcwn3g8KecBYdhPZbtqAf-XGmg-DFI2dbWNXIfuEPIqQDVgsyFmrrPVUN4zJlAh7Izxq7uQKdiZ-nh-AyXxYRGPKLZkZX43-TCUeG1pVS7xlLmVwb4PSEgVS27y5nqe-brjtnMKnwRJ94MQe6r5X5f7OOm3T2YvCISLxGrcN78

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 401085:401117.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5799131625029632

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000048
Crash State:
  aura::Window::GetRootWindow
  aura::Window::GetRootWindow
  aura::client::ParentWindowWithContext
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=397536:397683
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=401085:401117

Minimized Testcase (103.15 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95xdSQ7WVCE9H_oqiTT-w5nB_IZprfEU1wludmYWJEUCGsj0UhbZ8g6bxvOWPxRHc8Q0apmsQwU_AROgop1TS9bV1o_V28V81KCrnaiqc99GgLIrCchlE7rcLtFzWtpGMnT4uZYP8Fgxb_LCOTRryKdabHvEX_aPWa9SoCKNXjzFZoJa98?testcase_id=5799131625029632

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

I don't think this is fixed.
The crash is happening because we're setting the parent of a bubble to an aura::Window that is not attached to the root. NativeWidgetAura doesn't deal with this (more specifically aura::client::ParentWindowWithContext).
It seems like the validation bubble should not be displayed if the webcontents isn't attached to a valid root.

 Issue 619881  has been merged into this issue.

Scott, can you repro this on the above test cases? I can't (on stable or on tot). I don't know how or why the validation bubble is being triggered given the test case. It does seem likely that a validation message attached to a blocked-popup webcontents could be the culprit, but where exactly to early-abort is not clear to me (in BubbleDialogDelegate? In Browser::ShowValidationMessage? etc.) without being able to investigate the crash.

I was not unable to repro either. My guess is Browser::ShowValidationMessage is the right place for the early out.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ba9261ea5d0e1f9a8a29657d8f8fb369d9e9143d

commit ba9261ea5d0e1f9a8a29657d8f8fb369d9e9143d
Author: estade <estade@chromium.org>
Date: Tue Jun 28 00:47:11 2016

Don't attempt to show validation bubble for unparented web contents.

This fix is speculative because I can't actually repro the bug.

BUG= 616990 

Review-Url: https://codereview.chromium.org/2104513004
Cr-Commit-Position: refs/heads/master@{#402349}

[modify] https://crrev.com/ba9261ea5d0e1f9a8a29657d8f8fb369d9e9143d/chrome/browser/ui/browser.cc

maybe fixed? Not sure how to verify.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5743524545036288

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000080
Crash State:
  aura::Window::GetRootWindow
  aura::client::ParentWindowWithContext
  views::NativeWidgetAura::InitNativeWidget
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=209699:209703

Minimized Testcase (19.58 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95YEWPGYyRx4tihJlKVP5imOLCwVUankXfeXOePUrDnxijlyFw9Lbk9mV3TLq4DPpQLDCsJW766xT9dJSDKrisnXlii5-yTKtmFu9lU_L34esifC-I7dz0LcJA-Ebx3UkITxKU1P-VeQb8gs1ut9ldDWw4anDmSfYM6LTrl5X5h3LT8oms?testcase_id=5743524545036288

Filer: mmohammad

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this issue as fixed in range 398017:398351.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5743524545036288

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000080
Crash State:
  aura::Window::GetRootWindow
  aura::client::ParentWindowWithContext
  views::NativeWidgetAura::InitNativeWidget
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=209699:209703
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=398017:398351

Minimized Testcase (19.58 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95YEWPGYyRx4tihJlKVP5imOLCwVUankXfeXOePUrDnxijlyFw9Lbk9mV3TLq4DPpQLDCsJW766xT9dJSDKrisnXlii5-yTKtmFu9lU_L34esifC-I7dz0LcJA-Ebx3UkITxKU1P-VeQb8gs1ut9ldDWw4anDmSfYM6LTrl5X5h3LT8oms?testcase_id=5743524545036288

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

since this is p3, removing milestone

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot