This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Fix incoming

The following revision refers to this bug:
  https://skia.googlesource.com/skia.git/+/057ae8a15ddd2af639a829d63aca29cbc6b1bb57

commit 057ae8a15ddd2af639a829d63aca29cbc6b1bb57
Author: bsalomon <bsalomon@google.com>
Date: Sun Jul 24 12:37:26 2016

Fix misdetection of rectangles in SkPath::IsSimpleClosedRect.

BUG= chromium:630369 
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2175923002

Review-Url: https://codereview.chromium.org/2175923002

[modify] https://crrev.com/057ae8a15ddd2af639a829d63aca29cbc6b1bb57/src/core/SkPath.cpp
[modify] https://crrev.com/057ae8a15ddd2af639a829d63aca29cbc6b1bb57/tests/PathTest.cpp

The following revision refers to this bug:
  https://skia.googlesource.com/skia.git/+/057ae8a15ddd2af639a829d63aca29cbc6b1bb57

commit 057ae8a15ddd2af639a829d63aca29cbc6b1bb57
Author: bsalomon <bsalomon@google.com>
Date: Sun Jul 24 12:37:26 2016

Fix misdetection of rectangles in SkPath::IsSimpleClosedRect.

BUG= chromium:630369 
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2175923002

Review-Url: https://codereview.chromium.org/2175923002

[modify] https://crrev.com/057ae8a15ddd2af639a829d63aca29cbc6b1bb57/src/core/SkPath.cpp
[modify] https://crrev.com/057ae8a15ddd2af639a829d63aca29cbc6b1bb57/tests/PathTest.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7561529f31bed368176d9af97f627629b4892c94

commit 7561529f31bed368176d9af97f627629b4892c94
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Sun Jul 24 13:36:12 2016

Roll src/third_party/skia/ 5fa38fa28..057ae8a15 (1 commit).

https://chromium.googlesource.com/skia.git/+log/5fa38fa28796..057ae8a15ddd

$ git log 5fa38fa28..057ae8a15 --date=short --no-merges --format='%ad %ae %s'
2016-07-24 bsalomon Fix misdetection of rectangles in SkPath::IsSimpleClosedRect.

BUG= 630369 

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_blink_rel
TBR=tomhudson@google.com

Review-Url: https://codereview.chromium.org/2175173002
Cr-Commit-Position: refs/heads/master@{#407384}

[modify] https://crrev.com/7561529f31bed368176d9af97f627629b4892c94/DEPS

ClusterFuzz has detected this issue as fixed in range 407380:407388.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6210946716663808

Fuzzer: inferno_canvas_wrecker
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  GrShape::attemptToSimplifyPath
  GrDrawContext::internalDrawPath
  GrDrawContext::drawPath
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_chrome&range=401888:401934
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_chrome&range=407380:407388

Minimized Testcase (0.65 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97amG2lsW4qPCuRvv4MVdnimiP7N0GC86tWzXLHxBju9OUxrEFKzDaWALbm0eLmz1cjjl8jZUY8gg6DU_bmKX9Nt6Psh9-pe_xNoRqvdt2yTBc3tL9aFOwG2jl71KmxaToSgHam8JExfjKn8S6lAjoVwLU88g?testcase_id=6210946716663808

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

For posterity: This issue could cause a path to be rendered incorrectly as a rectangle with uninit coords. However, it is a visual error not a security error.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot