This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

timloh@, would you mind taking a look or suggesting another owner?

Updating to "Assigned"

meade@: Can you triage/reassign? :)

ClusterFuzz has detected this issue as fixed in range 412463:412479.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4819242891608064

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Use-after-poison READ 8
Crash Address: 0x7ed6285f68e0
Crash State:
  blink::ElementResolveContext::ElementResolveContext
  blink::StyleResolverState::StyleResolverState
  blink::StyleResolver::pseudoCSSRulesForElement
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=411927:411933
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=412463:412479

Minimized Testcase (20.52 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96a9TjaClWttg6N4BAuGzBdRRRZX_hRNdlQfRZkucxk1npxplkY8CZdcJPGnmm_4JFDr1514wNZ5RM3e6N710IfIbPlclp1A0E4fzzpqR1Q2SlF9YsSJD69X0DbLIHehcFOo4Mes59r4FnWXFwGxVI9-7862h1Z-KgdbXYMLhQawPSJypU?testcase_id=4819242891608064

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 412463:412479.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4819242891608064

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Use-after-poison READ 8
Crash Address: 0x7ed6285f68e0
Crash State:
  blink::ElementResolveContext::ElementResolveContext
  blink::StyleResolverState::StyleResolverState
  blink::StyleResolver::pseudoCSSRulesForElement
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=411927:411933
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=412463:412479

Minimized Testcase (20.52 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96a9TjaClWttg6N4BAuGzBdRRRZX_hRNdlQfRZkucxk1npxplkY8CZdcJPGnmm_4JFDr1514wNZ5RM3e6N710IfIbPlclp1A0E4fzzpqR1Q2SlF9YsSJD69X0DbLIHehcFOo4Mes59r4FnWXFwGxVI9-7862h1Z-KgdbXYMLhQawPSJypU?testcase_id=4819242891608064

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

So I didn't actually find anything when I looked into this bug. I'll leave it closed, and if clusterfuzz finds it again I'll take another look.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot