For this one, I believe some tables failed to parse. Then trying to read from them causes access to the underlying data classes, which are nullptrs.

 Issue 645561  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0c0e20baae5cfc32465e84d0e56a82ab874788e9

commit 0c0e20baae5cfc32465e84d0e56a82ab874788e9
Author: thestig <thestig@chromium.org>
Date: Tue Oct 25 01:05:52 2016

Roll DEPS for sfntly 1ef790a..e33ba7a

https://chromium.googlesource.com/external/github.com/googlei18n/sfntly/+log/1ef790a..e33ba7a

e33ba7a Merge pull request #60 from leizleiz/leizleiz-crbug
1bc53e1 Fix undefined shifts in ReadableFontData::ReadShort.
d651349 Check for negative size in NameTable::NameAsBytes.
8475d2f Avoid NULL derefs inside FontHeaderTable::Builder.
1fba3b3 Fix undefined shifts in ReadableFontData::ReadLong.
083b02b Fix NULL pointer derefs in sfntly::Font::Builder.
6d1efaa Fix out of bound access in subtly sample program.
cafc4c8 Merge pull request #59 from HalCanary/pronounciation
7d5169e README: pronounciation guide

BUG= 638573 , 641452 , 646300 , 646347 ,654663, 655914 
TBR=behdad@chromium.org

Review-Url: https://codereview.chromium.org/2444123002
Cr-Commit-Position: refs/heads/master@{#427203}

[modify] https://crrev.com/0c0e20baae5cfc32465e84d0e56a82ab874788e9/DEPS

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/00b023067c9a330d2041c81871b2804591522416

commit 00b023067c9a330d2041c81871b2804591522416
Author: thestig <thestig@chromium.org>
Date: Tue Oct 25 07:26:30 2016

Revert of Roll DEPS for sfntly 1ef790a..e33ba7a (patchset #1 id:1 of https://codereview.chromium.org/2444123002/ )

Reason for revert:
Broke some font rendering.

e.g.  https://crbug.com/659006 

Original issue's description:
> Roll DEPS for sfntly 1ef790a..e33ba7a
>
> https://chromium.googlesource.com/external/github.com/googlei18n/sfntly/+log/1ef790a..e33ba7a
>
> e33ba7a Merge pull request #60 from leizleiz/leizleiz-crbug
> 1bc53e1 Fix undefined shifts in ReadableFontData::ReadShort.
> d651349 Check for negative size in NameTable::NameAsBytes.
> 8475d2f Avoid NULL derefs inside FontHeaderTable::Builder.
> 1fba3b3 Fix undefined shifts in ReadableFontData::ReadLong.
> 083b02b Fix NULL pointer derefs in sfntly::Font::Builder.
> 6d1efaa Fix out of bound access in subtly sample program.
> cafc4c8 Merge pull request #59 from HalCanary/pronounciation
> 7d5169e README: pronounciation guide
>
> BUG= 638573 , 641452 , 646300 , 646347 ,654663, 655914 
> TBR=behdad@chromium.org
>
> Committed: https://crrev.com/0c0e20baae5cfc32465e84d0e56a82ab874788e9
> Cr-Commit-Position: refs/heads/master@{#427203}

TBR=behdad@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= 638573 , 641452 , 646300 , 646347 ,654663, 655914 

Review-Url: https://codereview.chromium.org/2445303002
Cr-Commit-Position: refs/heads/master@{#427296}

[modify] https://crrev.com/00b023067c9a330d2041c81871b2804591522416/DEPS

ClusterFuzz has detected this issue as fixed in range 427178:427235.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6176128974979072

Fuzzer: libfuzzer_sfntly_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  sfntly::MaximumProfileTable::Builder::NumGlyphs
  sfntly::Font::Builder::InterRelateBuilders
  sfntly::Font::Builder::BuildAllTableBuilders
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=414164:414272
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=427178:427235

Minimized Testcase (5.23 Kb): https://cluster-fuzz.appspot.com/download/AMIfv962zKQgxM-mEP8nizjBFqGsaByqNpf3essQiuGdDwSVEQSjv1G5YgzraTQWiUmbEtxSIbOSt5LNYiYgExtPn7MV2q52crvqbJYisz7PmYZXWjT7lIfhuOW5EiJUj8XUjobeJrbYOueRfYdW4oRrpmbtC-ryGg?testcase_id=6176128974979072

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

 Issue 659185  has been merged into this issue.

 Issue 659167  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7ac63a352e7556a68224284af29db855b400a679

commit 7ac63a352e7556a68224284af29db855b400a679
Author: thestig <thestig@chromium.org>
Date: Wed Oct 26 21:42:15 2016

Roll DEPS for sfntly 1ef790a..6e98497

6e98497 Merge pull request #61 from leizleiz/leizleiz-tablefix
ebaa364 Fix breakage from commit 083b02b1.
e33ba7a Merge pull request #60 from leizleiz/leizleiz-crbug
1bc53e1 Fix undefined shifts in ReadableFontData::ReadShort.
d651349 Check for negative size in NameTable::NameAsBytes.
8475d2f Avoid NULL derefs inside FontHeaderTable::Builder.
1fba3b3 Fix undefined shifts in ReadableFontData::ReadLong.
083b02b Fix NULL pointer derefs in sfntly::Font::Builder.
6d1efaa Fix out of bound access in subtly sample program.
cafc4c8 Merge pull request #59 from HalCanary/pronounciation
7d5169e README: pronounciation guide

BUG= 638573 , 641452 , 646300 , 646347 ,654663, 655914 , 659006 
TBR=behdad@chromium.org

Review-Url: https://codereview.chromium.org/2452873003
Cr-Commit-Position: refs/heads/master@{#427819}

[modify] https://crrev.com/7ac63a352e7556a68224284af29db855b400a679/DEPS

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot