Suspected CLs	No CL in the regression range changes the crashed files. The result is the blame information.

Author: mjs@apple.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/554c7634cddfec7925865257d362fa718c34ac3a
Time: Thu May 06 22:41:15 2010
The CL last changed line 748 of file Node.h, which is stack frame 0.

Author: commit-queue@webkit.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/a617e8a70e2f33152f9b00a7f6e86cd8ba8a29b5
Time: Sat Apr 21 00:18:20 2012
The CL last changed line 244 of file Node.h, which is stack frame 1.

Author: darin@apple.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/a631e609095b01bf92e43c22ed40b05aaa68d50b
Time: Mon Oct 18 19:52:27 2010
The CL last changed line 306 of file ContainerNode.h, which is stack frame 2.

Author: ch.dumez@samsung.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/77df0cd163cc0e13196aadf3a188f5991ab3508a
Time: Fri Feb 21 23:18:01 2014
The CL last changed line 226 of file Node.h, which is stack frame 3.

Author: ch.dumez@samsung.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/b76f46669447f9b9c0709da786fb4f69cb641feb
Time: Mon Jul 28 22:42:25 2014
The CL last changed line 263 of file NodeTraversal.h, which is stack frame 4.

Author: ch.dumez@samsung.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/5c77c7d2869ec1921bed356e8f7afa5ada7f0ee6
Time: Thu Feb 20 07:38:48 2014
The CL last changed line 53 of file NodeTraversal.h, which is stack frame 5.

Author: yosin@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/28e6e02ece333238e40f3b3de020c392b0dcfc9d
Time: Wed Jul 15 22:21:51 2015
The CL last changed line 465 of file DocumentMarkerController.cpp, which is stack frame 6.

Possible suspect : https://chromium.googlesource.com/chromium/src//+/28e6e02ece333238e40f3b3de020c392b0dcfc9d

Please reassign if this is not related to your change

Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This issue is Pri-1 but has already been moved once. Lowering the priority and moving to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5199635119603712

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x0000000b
Crash State:
  blink::DocumentMarkerController::markersInRange
  blink::SpellCheckRequest::create
  blink::SpellChecker::chunkAndMarkAllMisspellingsAndBadGrammar
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=403457:403667

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv944W8rvEt6k15E5QJcPLGFruwG4IH8Pp269NEC7XAKSENcZZZTV6ENKWSdgIiWReKGn2JrMt_9FImlM7ncQk9KQt15L4CPshpY-6gMnyXfowNMS9jY5K4BhuUU4umsiL1zdJlBhdK3saAqU9KdL9dzmgH1GqA?testcase_id=5199635119603712


Filer: ssamanoori

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4fb42e48b7175ccfabd887dc3ebb80a1697139e7

commit 4fb42e48b7175ccfabd887dc3ebb80a1697139e7
Author: yosin <yosin@chromium.org>
Date: Fri Jul 08 02:09:37 2016

Make EphemeralRange to accept only valid positions

This patch introduces |DCHECK_LE(start, end)| for start and end positions of
|EphemeralRange| constructor and changing call sites of constructor for
wrong start/end parameter case, to catch wrong call sites for improving code
health and ease of debugging.

This patch is intended to help to find the root cause of  crbug.com/624335 , which
causes null pointer reference for iterating over |nodeAsRangeFirstNode()|
of start of range to |nodeAsRangePastLastNode()| of end of range. We would
like to know which call site makes this wrong range.

BUG= 624335 
TEST=Covered by existing test

Review-Url: https://codereview.chromium.org/2124213002
Cr-Commit-Position: refs/heads/master@{#404308}

[modify] https://crrev.com/4fb42e48b7175ccfabd887dc3ebb80a1697139e7/third_party/WebKit/Source/core/editing/EphemeralRange.cpp
[modify] https://crrev.com/4fb42e48b7175ccfabd887dc3ebb80a1697139e7/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
[modify] https://crrev.com/4fb42e48b7175ccfabd887dc3ebb80a1697139e7/third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6379286298886144

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000010
Crash State:
  blink::DocumentMarkerController::markersInRange
  blink::SpellCheckRequest::create
  blink::SpellChecker::chunkAndMarkAllMisspellingsAndBadGrammar
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=371741:371854

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96B8eonYEWaVg_wvckEgF6Sad-rStL9092_8mrBISv1GT9oSaN-Q6M5eGm1bQi8VgokgLF1yYUGCgdKwRT9EBretZrlKb_8MW8K-K_Kw6XEOURBmMzFyCmyeUH-sjNgH60CO90nfHreCilyJ8uLWIgZvTyZFg?testcase_id=6379286298886144


Filer: rnimmagadda

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this issue as fixed in range 409147:409160.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6379286298886144

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000010
Crash State:
  blink::DocumentMarkerController::markersInRange
  blink::SpellCheckRequest::create
  blink::SpellChecker::chunkAndMarkAllMisspellingsAndBadGrammar
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=371741:371854
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=409147:409160

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96B8eonYEWaVg_wvckEgF6Sad-rStL9092_8mrBISv1GT9oSaN-Q6M5eGm1bQi8VgokgLF1yYUGCgdKwRT9EBretZrlKb_8MW8K-K_Kw6XEOURBmMzFyCmyeUH-sjNgH60CO90nfHreCilyJ8uLWIgZvTyZFg?testcase_id=6379286298886144


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot