weili, could you please take a look? looks like this might've been introduced in https://pdfium.googlesource.com/pdfium.git/+/5a6c1398d0e559fb6a048cb0dca46ba9f9309a77%5E%21/#F13:

   const auto& annots = m_pAnnotList->All();
-  return pdfium::ContainsValue(annots, p);
+  std::unique_ptr<const CPDF_Annot> annot(p);
+  return pdfium::ContainsValue(annots, annot);
 }


ASan stacktrace:

==4534==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000234210 at pc 0x7f49f2b4560d bp 0x7ffee600f090 sp 0x7ffee600f088
READ of size 8 at 0x604000234210 thread T0 (chrome)
    #0 0x7f49f2b4560c in CPDF_Annot::GetRect(CFX_FloatRect&) const third_party/pdfium/core/fpdfdoc/cpdf_annot.cpp:46:8
    #1 0x7f49f29493e3 in CPDFSDK_BAAnnot::GetRect() const third_party/pdfium/fpdfsdk/fsdk_baseannot.cpp:521:13
    #2 0x7f49f296db7d in CFFL_Button::OnLButtonDown(CPDFSDK_PageView*, CPDFSDK_Annot*, unsigned int, CFX_FloatPoint const&) third_party/pdfium/fpdfsdk/formfiller/cffl_formfiller.cpp:647:35
    #3 0x7f49f2952b55 in CFFL_IFormFiller::OnLButtonDown(CPDFSDK_PageView*, CPDFSDK_Annot*, unsigned int, CFX_FloatPoint const&) third_party/pdfium/fpdfsdk/formfiller/cffl_iformfiller.cpp:232:25
    #4 0x7f49f293cc98 in CPDFSDK_BFAnnotHandler::OnLButtonDown(CPDFSDK_PageView*, CPDFSDK_Annot*, unsigned int, CFX_FloatPoint const&) third_party/pdfium/fpdfsdk/fsdk_annothandler.cpp:524:29
    #5 0x7f49f2938e8e in CPDFSDK_AnnotHandlerMgr::Annot_OnLButtonDown(CPDFSDK_PageView*, CPDFSDK_Annot*, unsigned int, CFX_FloatPoint const&) third_party/pdfium/fpdfsdk/fsdk_annothandler.cpp:159:27
    #6 0x7f49f2935531 in CPDFSDK_PageView::OnLButtonDown(CFX_FloatPoint const&, unsigned int) third_party/pdfium/fpdfsdk/fsdk_mgr.cpp:776:25
    #7 0x7f49f28eb476 in FORM_OnLButtonDown third_party/pdfium/fpdfsdk/fpdfformfill.cpp:301:21
    #8 0x7f49e3abadcc in chrome_pdf::PDFiumEngine::OnMouseDown(pp::MouseInputEvent const&) pdf/pdfium/pdfium_engine.cc:1568:5
    #9 0x7f49e3ab9ad2 in chrome_pdf::PDFiumEngine::HandleEvent(pp::InputEvent const&) pdf/pdfium/pdfium_engine.cc:1183:12
    #10 0x7f49e3b123ff in chrome_pdf::OutOfProcessInstance::HandleInputEvent(pp::InputEvent const&) pdf/out_of_process_instance.cc:525:16
    #11 0x7f49e38c99e9 in pp::InputEvent_HandleEvent(int, int) ppapi/cpp/module.cc:53:32
    #12 0x7f49e990c95a in CallWhileUnlocked<PP_Bool, int, int, int, int> ppapi/shared_impl/proxy_lock.h:135:10
    #13 0x7f49e990c95a in ppapi::proxy::PPP_InputEvent_Proxy::OnMsgHandleFilteredInputEvent(int, ppapi::InputEventData const&, PP_Bool*) ppapi/proxy/ppp_input_event_proxy.cc:107
    #14 0x7f49e990c3d9 in DispatchToMethodImpl<ppapi::proxy::PPP_InputEvent_Proxy *, void (ppapi::proxy::PPP_InputEvent_Proxy::*)(int, const ppapi::InputEventData &, PP_Bool *), int, ppapi::InputEventData, PP_Bool, 0, 1, 0> base/tuple.h:179:3
    #15 0x7f49e990c3d9 in DispatchToMethod<ppapi::proxy::PPP_InputEvent_Proxy *, void (ppapi::proxy::PPP_InputEvent_Proxy::*)(int, const ppapi::InputEventData &, PP_Bool *), int, ppapi::InputEventData, PP_Bool> base/tuple.h:188
    #16 0x7f49e990c3d9 in bool IPC::MessageT<PpapiMsg_PPPInputEvent_HandleFilteredInputEvent_Meta, std::__1::tuple<int, ppapi::InputEventData>, std::__1::tuple<PP_Bool> >::Dispatch<ppapi::proxy::PPP_InputEvent_Proxy, ppapi::proxy::PPP_InputEvent_Proxy, void, void (ppapi::proxy::PPP_InputEvent_Proxy::*)(int, ppapi::InputEventData const&, PP_Bool*)>(IPC::Message const*, ppapi::proxy::PPP_InputEvent_Proxy*, ppapi::proxy::PPP_InputEvent_Proxy*, void*, void (ppapi::proxy::PPP_InputEvent_Proxy::*)(int, ppapi::InputEventData const&, PP_Bool*)) ipc/ipc_message_templates.h:173
    #17 0x7f49e990b64a in ppapi::proxy::PPP_InputEvent_Proxy::OnMessageReceived(IPC::Message const&) ppapi/proxy/ppp_input_event_proxy.cc:85:5
    #18 0x7f49e9879803 in ppapi::proxy::Dispatcher::OnMessageReceived(IPC::Message const&) ppapi/proxy/dispatcher.cc:70:17
    #19 0x7f49e9885bc9 in ppapi::proxy::PluginDispatcher::OnMessageReceived(IPC::Message const&) ppapi/proxy/plugin_dispatcher.cc:252:22
    #20 0x7f49e8825a6a in IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message const&) ipc/ipc_channel_proxy.cc:314:14
    #21 0x7f49e4c44b95 in Run base/callback.h:389:12
    #22 0x7f49e4c44b95 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:54
    #23 0x7f49e4a70c25 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:496:19
    #24 0x7f49e4a71a1f in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask) base/message_loop/message_loop.cc:505:5
    #25 0x7f49e4a7305a in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:629:13
    #26 0x7f49e4a7d9cd in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:35:31
    #27 0x7f49e4afdd59 in base::RunLoop::Run() base/run_loop.cc:35:10
    #28 0x7f49e384c1d0 in content::PpapiPluginMain(content::MainFunctionParams const&) content/ppapi_plugin/ppapi_plugin_main.cc:146:19
    #29 0x7f49e3aa2627 in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:343:14
    #30 0x7f49e3aa6e05 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:785:12
    #31 0x7f49e3aa13bd in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:20:28
    #32 0x7f49ddd5e5b5 in ChromeMain chrome/app/chrome_main.cc:85:12
    #33 0x7f49d2fd7f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I can repro this crash again with another PoC when I try to fill "date (yyyy-mm-dd)" option.

Almost every time when I open some PDF file contains "Rest or Print or Clear..." button and I click on some of them I get the crash. This should be fixed as soon as possible. Thanks!

Deleted: EHC_E_Fillable.pdf 405 KB

EHC_E_Fillable.pdf 405 KB Download

Any updates? M54 branch point is coming up and this is a Beta blocker.

It should be easy to fix. What ochang@ pointed is clearly wrong.

https://codereview.chromium.org/2242213004

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c0c3b125a5c48bae6486bbc8ab4c630c571e3afe

commit c0c3b125a5c48bae6486bbc8ab4c630c571e3afe
Author: thestig <thestig@chromium.org>
Date: Wed Aug 17 02:23:26 2016

Roll PDFium b469424..4674d95

https://pdfium.googlesource.com/pdfium.git/+log/b469424..4674d95

BUG= 62625 , 635848 
TBR=ochang@chromium.org

Review-Url: https://codereview.chromium.org/2245063005
Cr-Commit-Position: refs/heads/master@{#412427}

[modify] https://crrev.com/c0c3b125a5c48bae6486bbc8ab4c630c571e3afe/DEPS

Is this report qualified for a chromium security reward?

I don't see any specific reason why it wouldn't be, but it's up to the reward panel to decide.

And indeed, the panel awarded $1,000 for this!

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot