Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5215489337065472

Fuzzer: ipc_fuzzer_gen
Job Type: linux_asan_chrome_ipc
Platform Id: linux

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x60800002cce0
Crash State:
  ProfileIOData::FromResourceContext
  ChromeContentBrowserClient::CanCreateWindow
  content::RenderMessageFilter::OnCreateWindow
  
Recommended Security Severity: High


Minimized Testcase (693.28 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94HliiJXYxILI3AWtq7tLTcyPQts0sVt__oNCYrZQhH96-7EVeaeAPGIcrjNR9PUAO8oYruy099CZr83oIVE0lzV4k_KMy2V12bXtmZPGF6fV_FKVoF-rX5IjxAKiHB7sCl9lcC6eimzMYPMp8cUKlbK6P56x9w5K9sot3mn-7HESkWJxU?testcase_id=5215489337065472

Filer: inferno

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Would someone who works on browser profiles please look into this? As far as I can tell, the issue is that the ResourceContext is being prematurely destroyed, but because of the IPC messages going around, I am not sure how this has happened.

Hey mahmadi, can you triage this bug?

ClusterFuzz has detected this issue as fixed in range 407005:407057.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5215489337065472

Fuzzer: ipc_fuzzer_gen
Job Type: linux_asan_chrome_ipc
Platform Id: linux

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x60800002cce0
Crash State:
  ProfileIOData::FromResourceContext
  ChromeContentBrowserClient::CanCreateWindow
  content::RenderMessageFilter::OnCreateWindow
  
Recommended Security Severity: High

Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_ipc&range=407005:407057

Minimized Testcase (693.28 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94HliiJXYxILI3AWtq7tLTcyPQts0sVt__oNCYrZQhH96-7EVeaeAPGIcrjNR9PUAO8oYruy099CZr83oIVE0lzV4k_KMy2V12bXtmZPGF6fV_FKVoF-rX5IjxAKiHB7sCl9lcC6eimzMYPMp8cUKlbK6P56x9w5K9sot3mn-7HESkWJxU?testcase_id=5215489337065472

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 407167:407197.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5432781320749056

Fuzzer: ipc_fuzzer_gen
Job Type: linux_asan_chrome_ipc
Platform Id: linux

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x60800002e260
Crash State:
  ProfileIOData::FromResourceContext
  PlatformNotificationServiceImpl::CheckPermissionOnIOThread
  content::NotificationMessageFilter::OnClosePersistentNotification
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_ipc&range=386879:387082
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_ipc&range=407167:407197

Minimized Testcase (154.63 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96R9-Y0OQV-wuWgR2djY_9FKBy7cpl4sFMAmmQPs87LfGJQkHFcancD2KMCjjiWpFV2wysI6HVx5vjDGIKwfhL5LuoR7YXZk6v5r5BIXj93t098ctUsG7CROukyV4_GuyhBr0qFu86PaKwFPtg_jzV8rLrcxEHwwB_CoV9HfxK-RAYjeRQ?testcase_id=5432781320749056

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot