This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Dominic,

I believe this is related to your new AXTree fuzzer!

ClusterFuzz has detected this issue as fixed in range 421643:421698.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4657783641473024

Fuzzer: afl_ax_tree_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Heap-use-after-free READ 4
Crash Address: 0x6120000007f8
Crash State:
  ui::AXTree::UpdateNode
  ui::AXTree::Unserialize
  ui::AXTree::DestroyNodeAndSubtree
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=418256:418359
Fixed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=421643:421698

Minimized Testcase (0.05 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97WHy3m2IV-S4dhTKAItHvtiHAUY84Qh7j2A_dIyy-GaSnVR2yrf8IEdVJKfTkGftAohEJafbe2dCxdpnjWCOL8hlLwiuJgwl1vYVbT7rEPl5Pe8OKYgmUamDZwSoFqZbBFI_jQqIiwBSPQKbceyNgl38ws9g?testcase_id=4657783641473024

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot