Suspected CLs	No CL in the regression range changes the crashed files. The result is the blame information.

Author: tfarina@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/3db130eb9f60904eaa96abeae645a54fab33b9d0
Time: Thu Mar 27 08:14:48 2014
The CL last changed line 2639 of file event_sender.cc, which is stack frame 5.

Author: sigbjornf
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/8d568b12722f02dbb2ec358ce4600b96a673c481
Time: Wed Feb 24 21:29:47 2016
The CL last changed line 2665 of file event_sender.cc, which is stack frame 6.

Suspected Project: chromium

----------------------------

sigbjornf: Hey, would you mind checking the above issue as per above suspected CL in frame 6.

Thank you!

eventSender is used in a nested manner, generating an event input sequence that cannot happen outside of test code:

 * The testcase generates a sequence of input events which (eventually) performs a drag-and-drop operation.
 * That sequence is triggered by a focus event.
 * When the drop is concluded, another focus event will be dispatched.
 * That 2nd dispatch creates a nested drag-and-drop..something not supported nor possible in production code.
 * Upon completion of that inner drag, the outer/initial one is resumed..only to find internal drag state having been reset and invalidated.
 * Various things are bound to fail.

Test only issue, lowering priority accordingly.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5083266873032704

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x0000000001b8
Crash State:
  blink::DragController::concludeEditDrag
  blink::DragController::performDrag
  blink::WebViewImpl::dragTargetDrop
  

Minimized Testcase (0.56 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94-syx9WmfLwg9z8fefwiy3G2_irLRF1Eglb7ZE4YSj-_-t7d9GShdN90nwufZABfLaAd6_4U6wVifAdSof2ZW72LUsnEYSmJ93X8pu83iHMLz-giFnKJ1lyDB3ppQ7Kg6qdh0wPoNtknp5j3bhDDKeStfdFA?testcase_id=5083266873032704
<script>
function focusHandler() {
    runTest();
}
function runTest() {
    eventSender.mouseDown();
    eventSender.mouseUp();
    eventSender.mouseDown();
    eventSender.mouseUp();
    eventSender.leapForward(1000);
    eventSender.mouseDown();
    x = input.offsetParent.offsetLeft + input.offsetLeft + input.offsetWidth / 2;
    y = input.offsetParent.offsetTop + input.offsetTop + input.offsetHeight / 2;
    eventSender.mouseMoveTo(x, y);
    eventSender.mouseUp();
}
  </script>
    Dragme
  <input id="input" onfocus="focusHandler()">
  <script>
runTest();
  </script>


Filer: mmohammad

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this issue as fixed in range 402177:402198.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5083266873032704

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x0000000001b8
Crash State:
  blink::DragController::concludeEditDrag
  blink::DragController::performDrag
  blink::WebViewImpl::dragTargetDrop
  
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=402177:402198

Minimized Testcase (0.56 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94-syx9WmfLwg9z8fefwiy3G2_irLRF1Eglb7ZE4YSj-_-t7d9GShdN90nwufZABfLaAd6_4U6wVifAdSof2ZW72LUsnEYSmJ93X8pu83iHMLz-giFnKJ1lyDB3ppQ7Kg6qdh0wPoNtknp5j3bhDDKeStfdFA?testcase_id=5083266873032704
<script>
function focusHandler() {
    runTest();
}
function runTest() {
    eventSender.mouseDown();
    eventSender.mouseUp();
    eventSender.mouseDown();
    eventSender.mouseUp();
    eventSender.leapForward(1000);
    eventSender.mouseDown();
    x = input.offsetParent.offsetLeft + input.offsetLeft + input.offsetWidth / 2;
    y = input.offsetParent.offsetTop + input.offsetTop + input.offsetHeight / 2;
    eventSender.mouseMoveTo(x, y);
    eventSender.mouseUp();
}
  </script>
    Dragme
  <input id="input" onfocus="focusHandler()">
  <script>
runTest();
  </script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4657215384584192

Fuzzer: inferno_twister
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0x00000114
Crash State:
  blink::DragController::concludeEditDrag
  blink::DragController::performDrag
  blink::WebViewImpl::dragTargetDrop
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_content_shell&range=411291:411299

Minimized Testcase (0.90 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96dFJnVeeZBLpj1EZJwYfK8tJ2JsQFXWAez_Vlxul5gDuvh0mOqhmIPAP7ISunvVGONnsGfUWBp9Y7REbNvenJtXU2BW0dU04GqUln-dm9uBUINWbZwN3eK2YqyeZD2aSlhhhXd4h0ca2lsV8JNsy_NBgvAjg?testcase_id=4657215384584192

Additional requirements: Requires Gestures

Issue manually filed by: mmohammad

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz testcase 4657215384584192 is flaky and no longer reproduces, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.