Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5256099045572608

Fuzzer: renderer_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  partitionAllocGenericFlags
  partitionAllocGeneric
  fastMalloc
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94lfwmegO8DfgTXZLaW7GyRLKdxeC3HwJtMiIfRrgSI_1VLUKVFWMvUJ1wxIgr1KyuWrDXIiJRK21xh3bzgUH7ZiVNeNdVt2fsxtmzoIuPZHRffskYi9GZc4OXNtl202ilPYNJhkcRrCU-TdCQ9GleiQokR_A


Filer: mmoroz

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

sky@, could you please help to triage this?

I assumed that you may help, because you reviewed the fuzzer previously (https://codereview.chromium.org/2029323005/). Sorry if I'm wrong.

blink::CSSSelectorList::adoptSelectorVector is initiating the call to create allocate memory. I'm not familiar with that code. Passing to Ojan who hopefully can assign to the right person.

ClusterFuzz has detected this issue as fixed in range 408165:408299.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5103264244957184

Fuzzer: libfuzzer_renderer_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  AllocateSlotSet
  v8::internal::MemoryChunk::AllocateOldToNewSlots
  AllocateSlotSet
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=397702:398136
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=408165:408299

Minimized Testcase (0.00 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96QATxe4YnCWMR_5LU_Xew_EgmDvSB-W42XLAvCCVGUq4Jw9KGmrM_BRXIasVEXeE41MJcqToJzomiu5-i-UlNlpWqV_ajDltXgPuayCZUvZYbHukYyTZkshBYztu1H5_bS3q6WF1PCc-TwFxtSuN25xK8fcw?testcase_id=5103264244957184

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot