darin: Would you mind taking a look or reassigning this if you don't have time? Seems related to https://crrev.com/2b78d9ee821f4d5c8c31a05028360610f5d0069f

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/815c4cbb961e3c077f96b084cd00737f82035da3

commit 815c4cbb961e3c077f96b084cd00737f82035da3
Author: darin <darin@chromium.org>
Date: Mon Aug 08 21:05:31 2016

Revert "Port WebSockets to Mojo IPC"

This reverts commit 2b78d9ee821f4d5c8c31a05028360610f5d0069f due to memory corruption issues.

TBR=jam@chromium.org,tsepez@chromium.org
BUG=635397, 635602 
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_site_isolation

Review-Url: https://codereview.chromium.org/2225133002
Cr-Commit-Position: refs/heads/master@{#410456}

[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/browser/bad_message.cc
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/browser/bad_message.h
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/browser/frame_host/render_frame_host_impl.cc
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/browser/renderer_host/render_process_host_impl.cc
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/browser/renderer_host/websocket_blob_sender.cc
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/browser/renderer_host/websocket_blob_sender.h
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/browser/renderer_host/websocket_blob_sender_unittest.cc
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/browser/renderer_host/websocket_dispatcher_host.cc
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/browser/renderer_host/websocket_dispatcher_host.h
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/browser/renderer_host/websocket_dispatcher_host_unittest.cc
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/browser/renderer_host/websocket_host.cc
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/browser/renderer_host/websocket_host.h
[delete] https://crrev.com/fb357a6207caa3bb81bae702ada464ec39881d39/content/browser/websockets/websocket_impl.cc
[delete] https://crrev.com/fb357a6207caa3bb81bae702ada464ec39881d39/content/browser/websockets/websocket_impl.h
[delete] https://crrev.com/fb357a6207caa3bb81bae702ada464ec39881d39/content/browser/websockets/websocket_manager.cc
[delete] https://crrev.com/fb357a6207caa3bb81bae702ada464ec39881d39/content/browser/websockets/websocket_manager.h
[delete] https://crrev.com/fb357a6207caa3bb81bae702ada464ec39881d39/content/browser/websockets/websocket_manager_unittest.cc
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/child/OWNERS
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/child/blink_platform_impl.cc
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/child/blink_platform_impl.h
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/child/child_thread_impl.cc
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/child/child_thread_impl.h
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/child/websocket_bridge.cc
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/child/websocket_bridge.h
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/child/websocket_dispatcher.cc
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/child/websocket_dispatcher.h
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/child/websocket_message_filter.cc
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/child/websocket_message_filter.h
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/common/BUILD.gn
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/common/content_message_generator.h
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/common/websocket.cc
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/common/websocket.h
[delete] https://crrev.com/fb357a6207caa3bb81bae702ada464ec39881d39/content/common/websocket.mojom
[add] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/common/websocket_messages.h
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/content_browser.gypi
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/content_child.gypi
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/content_common.gypi
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/content_common_mojo_bindings.gyp
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/content_renderer.gypi
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/content_tests.gypi
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/renderer/OWNERS
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/renderer/render_frame_impl.cc
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/renderer/render_frame_impl.h
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/renderer/render_thread_impl.cc
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/renderer/render_thread_impl_browsertest.cc
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/renderer/renderer_blink_platform_impl.cc
[modify] https://crrev.com/815c4cbb961e3c077f96b084cd00737f82035da3/content/renderer/renderer_blink_platform_impl.h
[delete] https://crrev.com/fb357a6207caa3bb81bae702ada464ec39881d39/content/renderer/websockethandle_impl.cc
[delete] https://crrev.com/fb357a6207caa3bb81bae702ada464ec39881d39/content/renderer/websockethandle_impl.h

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4950007533010944

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x6080000a81f0
Crash State:
  content::RenderProcessHostImpl::ConnectionFilterImpl::GetInterface
  base::internal::Invoker<base::internal::BindState<void
  shell::internal::GenericCallbackBinder::BindInterface
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=411529:411875

Minimized Testcase (0.51 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97P8bdWONP1BtlsvqJv3GiPCj48KpL7SQVolzdVy7T5RtHvusC8nQzLtJRs0nCkUOJJNHPTXu6smiLHivgi26Cc0Yj4xY3yyssGBPuCxz8DCzgp2_obGzsxNOnbQnNsXzUx_kw4qlRkXbKKEd99r0I1LFSThg?testcase_id=4950007533010944

Issue manually filed by: mmoroz

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this issue as fixed in range 412308:412370.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4950007533010944

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x6080000a81f0
Crash State:
  content::RenderProcessHostImpl::ConnectionFilterImpl::GetInterface
  base::internal::Invoker<base::internal::BindState<void
  shell::internal::GenericCallbackBinder::BindInterface
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=411529:411875
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=412308:412370

Minimized Testcase (0.51 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97P8bdWONP1BtlsvqJv3GiPCj48KpL7SQVolzdVy7T5RtHvusC8nQzLtJRs0nCkUOJJNHPTXu6smiLHivgi26Cc0Yj4xY3yyssGBPuCxz8DCzgp2_obGzsxNOnbQnNsXzUx_kw4qlRkXbKKEd99r0I1LFSThg?testcase_id=4950007533010944

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ben: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Since the changeset is reverted, closing this. If you are planning to reland this, please land with the fix for the security vulnerability.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot