Suspected CLs	No CL in the regression range changes the crashed files. The result is the blame information.

Author: fmalita@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/c82dacd7af17c33b7f863ed9894f09fef5fbf59e
Time: Tue Jun 16 21:45:57 2015
The CL last changed line 133 of file LayoutSVGResourceClipper.cpp, which is stack frame 4.

Author: pdr
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/adade70750e7aa545e66de4e4c38827cebdb8fad
Time: Thu Oct 22 10:25:37 2015
The CL last changed line 142 of file LayoutSVGResourceClipper.cpp, which is stack frame 5.

Author: fs@opera.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/9e33b03ec57581ed95659565463f369c69d84b58
Time: Wed Aug 26 22:16:20 2015
The CL last changed line 59 of file SVGClipPainter.cpp, which is stack frame 6.

Suspected Project: chromium-skia
Suspected Component: Internals>Skia
--------------------------------------------------------

@fmalita: Hey, would you mind checking the above issue as per above suspected CL in frame 4 ?

Appreciate the help.

Thank you!

The minimized test crashes in debug mode only (null pointer deref).  Skia pathops repro:

        SkPath path0;
        path0.moveTo(140, 40);
        path0.lineTo(200, 210);
        path0.lineTo(40, 100);
        path0.lineTo(2.22223e+07f, 2.22222e+14f);
        path0.lineTo(2.22223e+07f, 2.22222e+14f);

        SkPath path1;
        path1.moveTo(160, 60);
        path1.lineTo(220, 230);
        path1.lineTo(60, 120);
        path1.lineTo(2.22223e+07f, 2.22222e+14f);
        path1.lineTo(2.22223e+07f, 2.22222e+14f);

        SkOpBuilder builder;
        builder.add(path0, SkPathOp::kUnion_SkPathOp);
        builder.add(path1, SkPathOp::kUnion_SkPathOp);
        builder.resolve(&path0);

Cary PTAL.

The following revision refers to this bug:
  https://skia.googlesource.com/skia.git/+/013e0e6d482f61181b829bf5ebfcad912c0061b1

commit 013e0e6d482f61181b829bf5ebfcad912c0061b1
Author: caryclark <caryclark@google.com>
Date: Fri Jun 10 14:59:50 2016

add fail condition to addexpanded

If coincident pairs don't match,
give up rather than deref null.

R=fmalita@chromium.org
BUG= 618991 
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2058773002

Review-Url: https://codereview.chromium.org/2058773002

[modify] https://crrev.com/013e0e6d482f61181b829bf5ebfcad912c0061b1/src/pathops/SkOpCoincidence.cpp
[modify] https://crrev.com/013e0e6d482f61181b829bf5ebfcad912c0061b1/tests/PathOpsBuilderTest.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c13c6b17c4425080642a2d04e2d846ae4d278ef7

commit c13c6b17c4425080642a2d04e2d846ae4d278ef7
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Fri Jun 10 16:32:50 2016

Roll src/third_party/skia/ 5dfe7bbcf..7049396b6 (4 commits).

https://chromium.googlesource.com/skia.git/+log/5dfe7bbcfda3..7049396b6566

$ git log 5dfe7bbcf..7049396b6 --date=short --no-merges --format='%ad %ae %s'
2016-06-10 bsalomon Make GrShape capable of representing inverse filled rrects. GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2056523002
2016-06-10 caryclark add fail condition to addexpanded
2016-06-10 djsollen Cleanup VulkanWindowContext for use on Android GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2058763002
2016-06-10 bsalomon Add blurcircles to blacklist for macmini4.1

BUG= 618991 

CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel
TBR=mtklein@google.com

Review-Url: https://codereview.chromium.org/2058793002
Cr-Commit-Position: refs/heads/master@{#399206}

[modify] https://crrev.com/c13c6b17c4425080642a2d04e2d846ae4d278ef7/DEPS

ClusterFuzz has detected this issue as fixed in range 399164:399234.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4567988141555712

Fuzzer: attekett_dom_fuzzer
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  SkOpCoincidence::addExpanded
  HandleCoincidence
  OpDebug
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=209699:209703
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=399164:399234

Minimized Testcase (0.44 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96YLouxRV_00wHwbfOOvcNyYGXJboKGLqNs3r19173pt_Fdic8Vnas_lhOrA5uBSdHikCA6ntAp8tImUxbIXmVtmDCg5Vm5LE_HmyjXm4YCQxBIGy3NURvywAtrWi_AdtG9RmCky2zYNSAvzhsC3VS2QxFMXg
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<defs>
    <path id="star" d="m 100,0 60,170 -160,-110 22222222
222222222222200,0 -170,110 z" transform="translate(40,40)"/>
    <clipPath id="clip">
        <use xlink:href="#star" clip-rule="evenodd"/>
        <use xlink:href="#star" transform="translate(20,20)"/>
    </clipPath>
</defs>
<rect height="300" width="300" style="fill:green;clip-path:url(#clip);"/>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5250990131642368

Fuzzer: attekett_dom_fuzzer
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  SkOpCoincidence::addExpanded
  HandleCoincidence
  OpDebug
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=144946:145047

Minimized Testcase (0.79 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94eeOzDUlh3tUkSYOvoZlH-ZM66lcNDFg5azWT4WgsKi4G4bavJeAiFCn8GPmEHBqEZ1C82AyFxIkjFovU2s_92jKIH_7LImOAM2oSo0JV_McHZlOlyUi0qtV-rOzaACMFZipmdeOjlfMqKNoniLkw2WiTcUQ

Filer: brajkumar

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this issue as fixed in range 399164:399234.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5250990131642368

Fuzzer: attekett_dom_fuzzer
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  SkOpCoincidence::addExpanded
  HandleCoincidence
  OpDebug
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=144946:145047
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=399164:399234

Minimized Testcase (0.79 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94eeOzDUlh3tUkSYOvoZlH-ZM66lcNDFg5azWT4WgsKi4G4bavJeAiFCn8GPmEHBqEZ1C82AyFxIkjFovU2s_92jKIH_7LImOAM2oSo0JV_McHZlOlyUi0qtV-rOzaACMFZipmdeOjlfMqKNoniLkw2WiTcUQ

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c13c6b17c4425080642a2d04e2d846ae4d278ef7

commit c13c6b17c4425080642a2d04e2d846ae4d278ef7
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Fri Jun 10 16:32:50 2016

Roll src/third_party/skia/ 5dfe7bbcf..7049396b6 (4 commits).

https://chromium.googlesource.com/skia.git/+log/5dfe7bbcfda3..7049396b6566

$ git log 5dfe7bbcf..7049396b6 --date=short --no-merges --format='%ad %ae %s'
2016-06-10 bsalomon Make GrShape capable of representing inverse filled rrects. GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2056523002
2016-06-10 caryclark add fail condition to addexpanded
2016-06-10 djsollen Cleanup VulkanWindowContext for use on Android GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2058763002
2016-06-10 bsalomon Add blurcircles to blacklist for macmini4.1

BUG= 618991 

CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel
TBR=mtklein@google.com

Review-Url: https://codereview.chromium.org/2058793002
Cr-Commit-Position: refs/heads/master@{#399206}

[modify] https://crrev.com/c13c6b17c4425080642a2d04e2d846ae4d278ef7/DEPS

fmalita@ : This issue is detected by clusterfuzz and impacting to Stable (51.0.2704.84) and Beta (52.0.2743.41). Can it be merged M 52.

I think it's safe to merge to M52.

[Automated comment] DEPS changes referenced in bugdroid comments, needs manual review.

Approving merge to M52 branch 2743 based on comment #11. Please merge ASAP. Thank you.

 Issue 621225  has been merged into this issue.

The following revision refers to this bug:
  https://skia.googlesource.com/skia.git/+/d733ddceef018d5ec7d715b059cee05b5b3aa304

commit d733ddceef018d5ec7d715b059cee05b5b3aa304
Author: fmalita <fmalita@chromium.org>
Date: Sat Jun 18 11:47:49 2016

[M52] add fail condition to addexpanded

(cherry-pick of 013e0e6d482f61181b829bf5ebfcad912c0061b1)

If coincident pairs don't match,
give up rather than deref null.

TBR=fmalita@chromium.org,caryclark@google.com
BUG= 618991 
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2058773002

Review-Url: https://codereview.chromium.org/2058773002
NOTREECHECKS=true
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2078183002

[modify] https://crrev.com/d733ddceef018d5ec7d715b059cee05b5b3aa304/src/pathops/SkOpCoincidence.cpp
[modify] https://crrev.com/d733ddceef018d5ec7d715b059cee05b5b3aa304/tests/PathOpsBuilderTest.cpp

caryclark@, please have the CL merged in to M52 branch by EOD so that it gets picked up for beta promotion scheduled this week.

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot