The result is a list of CLs that change the crashed files.

Author: haraken
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/adbe3f34c435039528111c045a832f74e6a93e8f
Time: Thu Jul 14 01:33:47 2016
Lines 327-331 of file CanvasAsyncBlobCreator.cpp which potentially caused crash are changed in this cl (frame #1, "blink::CanvasAsyncBlobCreator::encodeImageOnEncoderThread").
Minimum distance from crash line to modified line: 0. (file: CanvasAsyncBlobCreator.cpp, crashed on: 327, modified: 327).

Suspected Project: chromium
Suspected Component: Blink>HTML

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/03bcb665d7a873fd0694ec012da11d93a5ac4356

commit 03bcb665d7a873fd0694ec012da11d93a5ac4356
Author: haraken <haraken@chromium.org>
Date: Wed Aug 17 04:23:01 2016

Use ParentFrameTaskRunners for encodeImageOnEncoderThread

encodeImageOnEncoderThread should not use TaskRunnerHelper::get()
because it posts a task from a worker thread to the main thread.
Alternately, it should use ParentFrameTaskRunners.

BUG= 637974 

Review-Url: https://codereview.chromium.org/2253813002
Cr-Commit-Position: refs/heads/master@{#412449}

[modify] https://crrev.com/03bcb665d7a873fd0694ec012da11d93a5ac4356/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
[modify] https://crrev.com/03bcb665d7a873fd0694ec012da11d93a5ac4356/third_party/WebKit/Source/core/html/canvas/CanvasAsyncBlobCreator.cpp
[modify] https://crrev.com/03bcb665d7a873fd0694ec012da11d93a5ac4356/third_party/WebKit/Source/core/html/canvas/CanvasAsyncBlobCreator.h
[modify] https://crrev.com/03bcb665d7a873fd0694ec012da11d93a5ac4356/third_party/WebKit/Source/core/html/canvas/CanvasAsyncBlobCreatorTest.cpp
[modify] https://crrev.com/03bcb665d7a873fd0694ec012da11d93a5ac4356/third_party/WebKit/Source/core/workers/InProcessWorkerMessagingProxy.cpp
[modify] https://crrev.com/03bcb665d7a873fd0694ec012da11d93a5ac4356/third_party/WebKit/Source/core/workers/ParentFrameTaskRunners.cpp
[modify] https://crrev.com/03bcb665d7a873fd0694ec012da11d93a5ac4356/third_party/WebKit/Source/core/workers/ParentFrameTaskRunners.h
[modify] https://crrev.com/03bcb665d7a873fd0694ec012da11d93a5ac4356/third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp
[modify] https://crrev.com/03bcb665d7a873fd0694ec012da11d93a5ac4356/third_party/WebKit/Source/web/WebSharedWorkerImpl.cpp

ClusterFuzz has detected this issue as fixed in range 412439:412451.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6238693277040640

Fuzzer: inferno_twister
Job Type: linux_asan_chrome_media
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  blink::TaskRunnerHelper::get
  blink::CanvasAsyncBlobCreator::encodeImageOnEncoderThread
  base::WorkerThread::ThreadMain
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_media&range=405185:405467
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_media&range=412439:412451

Minimized Testcase (25.25 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95R4MFqHeG8qYT7U5UcoQCJT0T2Od-Fq6DcZHjrNNeT3w-skgQXLLpXUVlZ9G48eYrhUsNnYrRB2BN1xsSwzV8otPc_ax9nvxgyz6OSI4FrQiVcHVMk8qFvKunmUEsQpklc-4gevNG8Mbe6BKV7_SQpLYSrpSsDhEZpV7z4iALy6XolzrE?testcase_id=6238693277040640

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot