Suspected CLs	Regression information is not available. The result is the blame information.

Author: jchaffraix@webkit.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/d82167fe2ae971dbd628549c2081350299e6aab5
Time: Thu Jun 07 04:20:47 2012
The CL last changed line 240 of file PaintLayer.h, which is stack frame 0.

Author: wangxianzhu
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/580ba30eac72aa1c0bf2b93d31a0843211deba92
Time: Tue May 17 20:24:08 2016
The CL last changed line 39 of file BoxClipper.cpp, which is stack frame 1.

Author: dsinclair@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/735bbbde69644fc8a35d022b715c9db905b52846
Time: Thu Feb 26 16:03:40 2015
The CL last changed line 54 of file BlockPainter.cpp, which is stack frame 2.

Author: dsinclair@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/5c5ca93a02c312f533ea2922bb53f8f12b133a42
Time: Tue May 05 20:17:05 2015
The CL last changed line 23 of file SVGTextPainter.cpp, which is stack frame 3.

Author: pdr@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/aaab72fba54055de3d8909f88ce62302e6b7360b
Time: Thu Sep 25 00:47:50 2014
The CL last changed line 347 of file LayoutSVGText.cpp, which is stack frame 4.

Author: chrishtr@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/7a25d907698e89274bebe3cabf8865bff2b63384
Time: Wed Sep 10 16:29:19 2014
The CL last changed line 44 of file BoxPainter.cpp, which is stack frame 5.

Author: dsinclair@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/5c5ca93a02c312f533ea2922bb53f8f12b133a42
Time: Tue May 05 20:17:05 2015
The CL last changed line 93 of file SVGRootPainter.cpp, which is stack frame 6.

Suspected Project: chromium
Suspected Component: Blink>Paint
---------------------------------

@jchaffraix: Hey, would you mind checking the above issue and see if its related to your change ?
Also, ccing few dev of related change.

Thank you!

This looks like it could be a dupe of issue 613929.

Yes, this bug is also about LayoutSVGText which doesn't have a layer.

ClusterFuzz has detected this issue as fixed in range 399276:400924.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5807910672400384

Fuzzer: inferno_twister
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000008
Crash State:
  blink::PaintLayer::isSelfPaintingLayer
  blink::BoxClipper::BoxClipper
  blink::BlockPainter::paint
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=398006:398016
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=399276:400924

Minimized Testcase (3.62 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94aCafkpkp6WS8B4c787sFEv2tKBQiAhaina329v1HtHR9w6bvHIdpGWAc0iv0Dpn4q4VgNfzTDcngGhQ6ycySCFR1EVBO-uGGX3SnAHQD3vzUHUY-QaM5CkUhqt9TFYNsbQfBlZOkfUmSnYGz5cfr3W_qYug?testcase_id=5807910672400384

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot