This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

flackr -> can you confirm this is the same as  issue 645991 , if so dup and close.

ClusterFuzz has detected this issue as fixed in range 417889:417901.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4547802195820544

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: Heap-use-after-free READ {*}
Crash Address: 0xbcb3495c
Crash State:
  cc::Scheduler::BeginImplFrameWithDeadline
  base::internal::Invoker<base::internal::BindState<void
  base::CancelableCallback<void
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=417749:417791
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=417889:417901

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94NF3p4Yz7XUOYgkr-Kh3WA6o11UGmMqdzweNYdgS_q71gzq2vmoS6gJlfM74PfjhsTg2XRmqxC0XlIVaPq_bR-UUBFhV0ixno4qgbnUj5XzPUzuLefjTVnC05vZU_JIfbd-B07vwxfkCNSwyBCIfUC4ZzYhw?testcase_id=4547802195820544


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

The test case doesn't create a Compositor worker so it couldn't have been the crash I was looking at.

Looking at the regressed and fixed ranges, I suspect it may have been caused by 559280b26cc5672f5f054e8ac35281e804c14d78 as this change landed in the regressed range and was reverted in the fixed range.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot