bugsnash@, looks like you've recently touched that code. Could you please take a look?

Also it may be similar to bug 638112.

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

My change was a simple rename so is not the cause. I've reduced the test case (attached)

Deleted: play.html 3.1 KB

play.html 3.1 KB View Download

eae@, could you take a look? Might be related to  bug 638230 . 

ClusterFuzz has detected this issue as fixed in range 412463:412479.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5262317824770048

Fuzzer: inferno_twister_custom_bundle
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Use-after-poison READ 8
Crash Address: 0x7e97e9ed0e10
Crash State:
  blink::SVGLengthContext::convertValueToUserUnits
  blink::SVGLengthTearOff::value
  blink::SVGLengthTearOffV8Internal::valueAttributeGetterCallback
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=411927:411933
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=412463:412479

Minimized Testcase (7.26 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97uVK3nTGo8aeYPWq9L3yVwG1w2pC31WSDMgfLNgNn1HTEoSvq95jEQK-xFGlh9FiIpFElc9hzlM1hAcH6WD3Sew8fgSKzH9jTDT6lVz6b4VWG7P1rbJ1rWlZgA0bm9_EZ7P56lN4lfM-cWS9Swcj-ohnb6qA?testcase_id=5262317824770048

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot