This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Isolated Skia repro:

static void fuzz763_1(skiatest::Reporter* reporter, const char* filename) {
    SkPath path;
    path.setFillType((SkPath::FillType) 0);
path.moveTo(SkBits2Float(0x00000000), SkBits2Float(0x00000000));  // 0, 0
path.cubicTo(SkBits2Float(0x0000ff07), SkBits2Float(0xf9f9ff00), SkBits2Float(0xfe0ef9f4), SkBits2Float(0xd9b105fb), SkBits2Float(0x000000f9), SkBits2Float(0xfe11f901));  // 9.14866e-41f, -1.62257e+35f, -4.75121e+37f, -6.22846e+15f, 3.48923e-43f, -4.85077e+37f
path.lineTo(SkBits2Float(0xda1905ed), SkBits2Float(0x3c05fbfb));  // -1.0768e+16f, 0.00817775f
path.cubicTo(SkBits2Float(0x3c3c3c3c), SkBits2Float(0x3c3c3c3c), SkBits2Float(0x253c7f00), SkBits2Float(0xfa00d3fa), SkBits2Float(0x250025fe), SkBits2Float(0x00000006));  // 0.011489f, 0.011489f, 1.63494e-16f, -1.67228e+35f, 1.11151e-16f, 8.40779e-45f

    SkPath path1(path);
    path.reset();
    path.setFillType((SkPath::FillType) 0);
path.moveTo(SkBits2Float(0x00000000), SkBits2Float(0x00000000));  // 0, 0
path.quadTo(SkBits2Float(0x3c3c3c3c), SkBits2Float(0xfa253c3c), SkBits2Float(0xfefa00d3), SkBits2Float(0x25fad9df));  // 0.011489f, -2.14488e+35f, -1.66156e+38f, 4.35157e-16f
path.lineTo(SkBits2Float(0x00000000), SkBits2Float(0x00000000));  // 0, 0
path.close();
path.moveTo(SkBits2Float(0x00000000), SkBits2Float(0x00000000));  // 0, 0
path.lineTo(SkBits2Float(0x8dfefa00), SkBits2Float(0xf0f9fad9));  // -1.57141e-30f, -6.1892e+29f
path.cubicTo(SkBits2Float(0x20fe58f9), SkBits2Float(0x0525fbed), SkBits2Float(0x1905ffff), SkBits2Float(0x01f9f9f9), SkBits2Float(0xfbfe0ef9), SkBits2Float(0xfb212fff));  // 4.30882e-19f, 7.80453e-36f, 6.92764e-24f, 9.18268e-38f, -2.63829e+36f, -8.36933e+35f

    SkPath path2(path);
    testPathOp(reporter, path1, path2, (SkPathOp) 2, filename);
}

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5848078057996288

Fuzzer: afl_skia_pathop_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x610100010ee8
Crash State:
  SkOpAngle::setSpans
  SkOpAngle::set
  SkOpSegment::calcAngles
  
Recommended Security Severity: Medium


Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94Z3wldAcnV3QkPpq36Uk5-i6erp7jBCRcqGyPCqXhpILGXAefRq1h1q5A4nxJ7E5qheHxrRXizxxeQVNbNFKjyNWiQSbmdH6-SSOV5Fyhyx0JYMhcGXHQuJco7SJ_0dszYlMtpgyj5t27GhrA6Byy7kfxzOw?testcase_id=5848078057996288


Filer: mmoroz

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

M53 beta launch is coming soon.Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix before 6:00 PM PST, Monday (07/18/16). Thank you.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6450211937583104

Fuzzer: afl_skia_pathop_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x6101000059b0
Crash State:
  SkOpAngle::setSpans
  SkOpAngle::set
  SkOpSegment::calcAngles
  
Recommended Security Severity: Medium


Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97WvZArxq_cdMoFj9gu_-yvxS6kovDfudHjH2ZU3GGbnwyC5S3PDKCW47Z_e2jAOzzEsEKPdWT0SmdxQ3k_OEEJEpKvQvcUsmjmPbjQtZLKmCIWUVGq80WJVa-glmzz9zvA1rEwF2YgQhRiPTy3P4uZKxQudg?testcase_id=6450211937583104


Filer: mmoroz

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Fixed? Can't repro on ToT with any of the above test cases.

M53 beta launch is next week.Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix before 6:00 PM PST, Friday (07/22/16). Thank you.

ClusterFuzz has detected this issue as fixed in range 406032:406205.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6374307836198912

Fuzzer: afl_skia_pathop_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x610100007db0
Crash State:
  SkOpAngle::setSpans
  SkOpAngle::set
  SkOpSegment::calcAngles
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=402185:402404
Fixed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=406032:406205

Minimized Testcase (0.12 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94dME2EMQRz-sq50bmtH6o8Gv5xP1i89P-PAvCmflR7foY4VxtztlkERMogkEeHyVHhUwsn-4nbF2VLaVBWAhq2hTCedwjjnk6j0Tm6M19wt2juoaM2kL0Zc0gWBCt5Cd48rQKKHtRkdMnpqkj-gfdrBcC_yA?testcase_id=6374307836198912

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot