Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6466140427780096

Fuzzer: attekett_dom_fuzzer
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 4
Crash Address: 0x7f6f0b18c184
Crash State:
  ff_init_ff_cos_tabs
  ff_rdft_init
  av_rdft_init
  

Minimized Testcase (0.68 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95bS6efndeGX_UBCn6radBablXcFj-AJqVQ06473EAg7QJyPK1LH7RmyFPTuB1tbcU0khZx12Teg07uTHXbWNaN_Z6Gi3bM8VD1OxYWbQWyb5rffFwQ4AIuzahj2Wq0-RnqPflJizY8O2V5rsiWPaafk7VRHA?testcase_id=6466140427780096
<script>
var sampleRate = 44100.0;
var renderLengthSeconds = 8;
var pulseLengthSeconds = 1;
var pulseLengthFrames = pulseLengthSeconds * sampleRate;
function createSquarePulseBuffer(context, sampleFrameLength) {
    var audioBuffer = context.createBuffer(1, sampleFrameLength, context.sampleRate);
    return audioBuffer;
}
    var context = new OfflineAudioContext(2, sampleRate * renderLengthSeconds, sampleRate);
    var squarePulse = createSquarePulseBuffer(context, pulseLengthFrames);
    var convolver = context.createConvolver();
    convolver.buffer = squarePulse;
    convolver.connect(context.destination);
    context.startRendering();
    convolver.buffer = squarePulse;
  </script>


Filer: ajha

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.