malaykeshav @ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/63903481bbfd5173416a223bf160fc106f62d1b7

commit 63903481bbfd5173416a223bf160fc106f62d1b7
Author: malaykeshav <malaykeshav@chromium.org>
Date: Thu Sep 22 23:08:20 2016

Security fix while computing dropdown menu arrow width

There is no clean way to set the size for the dropdown menu arrow dynamically
without causing security bugs. Since this is only for tests, using a fixed
width works with _most_ of the test cases while the rest have minor changes
that are acceptable for layout tests.

Context: https://codereview.chromium.org/2340633002

BUG= 649095 ,  649056 ,  649058 ,  649132 ,  640256 
COMPONENT=ThemePainterDefault, Menu List Arrow
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2359753003
Cr-Commit-Position: refs/heads/master@{#420492}

[modify] https://crrev.com/63903481bbfd5173416a223bf160fc106f62d1b7/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/63903481bbfd5173416a223bf160fc106f62d1b7/third_party/WebKit/Source/core/paint/ThemePainterDefault.cpp

ClusterFuzz has detected this issue as fixed in range 420372:420502.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5248712253374464

Fuzzer: bj_broddelwerk
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000040
Crash State:
  blink::ThemePainterDefault::setupMenuListArrow
  blink::ThemePainterDefault::paintMenuListButton
  blink::BoxPainter::paintBoxDecorationBackgroundWithRect
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=419848:419971
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=420372:420502

Minimized Testcase (0.13 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96lNMZdTP51xV-uKU_2AQSn7Wk1830InOd0a9-iJhBnpkPuN6wo--0lnzONu86h1qhtaAwf0laNioHjUJiRtKrMkXPx61fP-VOe8GDADJNeO4nsTGV_6Iwa1lZwrdrTEM-wMpiwsF5WQNtJbweyn49q1BQkng?testcase_id=5248712253374464
<style>
.CLASS1{font-variant:inherit;-webkit-appearance:menulist-button;outline-style:double;</style>
<table class="CLASS12 CLASS1">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot