uthor: sigbjornf
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/7de35e892724a0307ddd6440c69a2223e0fd4755
Time: Mon Apr 25 11:13:06 2016
The CL last changed line 1429 of file ThreadState.cpp, which is stack frame 2.

Author: sigbjornf
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/3e5bcb132b1af136ba6faa1c152dcba2c298549f
Time: Mon May 23 14:28:16 2016
The CL last changed line 239 of file Persistent.h, which is stack frame 3.

Author: sigbjornf
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/3e5bcb132b1af136ba6faa1c152dcba2c298549f
Time: Mon May 23 14:28:16 2016
The CL last changed line 98 of file Persistent.h, which is stack frame 4.

@sigbjornf: Assigning to you, request you to please take a look into it. Please help us to reassign if not with respect to your changes.

Thanks.!

keishi@: Is this also related to the per-thread heap?

I don't see Workers being used in the test case so I think this is unrelated. Looks like complication during shutdown.

I'm guessing the base::bind created here is being destructed after main ThreadState has detached

https://cs.chromium.org/chromium/src/third_party/WebKit/Source/modules/battery/BatteryDispatcher.cpp?type=cs&sq=package:chromium&rcl=1475695348&l=23

Okay. I'm working on removing the shutdown code, although it will take a couple of more time: https://codereview.chromium.org/2309153002/

ClusterFuzz has detected this issue as fixed in range 423881:423995.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6167544966938624

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000010
Crash State:
  blink::ThreadState::freePersistentNode
  base::internal::BindState<void
  device::blink::BatteryMonitor_QueryNextStatus_ForwardToCallback::~BatteryMonitor
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=417858:417859
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=423881:423995

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96tJLj_heX2zCGOAjXh5qdFDkWoBaNIwtuDJD3mzNHZgLgFnv-XSWiMEOgCfHrsFto4IulqCaELm68DF1IMAj_jXDN9PMP5LzVOB-t6UwpwJD2XgyvvVeTgGdDlPO80B3xG2ClEpZawlJ13p3jf4gbKePBWcxLFuwGeSXZkAFClLTIYxuk?testcase_id=6167544966938624


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot