Author: kouhei
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/afa48c3ed31f7229c306ce7cda62111be593f719
Time: Thu Oct 13 03:04:01 2016
Lines 146-151 of file CSSStyleSheetResource.cpp which potentially caused crash are changed in this cl (frame #3, "blink::CSSStyleSheetResource::checkNotify").

Lines 441-462 of file HTMLLinkElement.cpp which potentially caused crash are changed in this cl (frame #2, "blink::LinkStyle::setCSSStyleSheet").
Minimum distance from crash line to modified line: 0. (file: HTMLLinkElement.cpp, crashed on: 441, modified: 441).

Suspected Project: chromium
Suspected Component: Blink>Loader

Hm it looks like resourceBuffer() is null but we didn't hit the DCHECK. 
mummareddy: are fuzzers running with DHCECKs on these days? How can I check that?

I can repro on TOT #425249 with an asan build. Ha "minimized testcase". Moving kouhei to cc and I'll see if I can look into this today.

Ha! The crash is caused if we try loading a CSS file with 0 length :) Will try to send out a fix.

ClusterFuzz has detected this issue as fixed in range 425603:425612.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5343837331652608

Fuzzer: inferno_webbot
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000001c
Crash State:
  blink::SharedBuffer::mergeSegmentsIntoBuffer
  blink::SharedBuffer::data
  blink::LinkStyle::setCSSStyleSheet
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=424939:424963
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=425603:425612

Minimized Testcase (0.06 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95RSA1N2N7gZfAotk1afCwP2xykF_1f84DskxtzRyjYtu59MmJAYG9XIgEHzVmlR4CIevfaGIXWxl93dF7zqCL7y2HZYUu2XaNizhDLlj3BVWhtDBiBo9gwpK-kgjvPdz46uF1sXGJOpTwdLavh8olzhRGACQ?testcase_id=5343837331652608
<script>
window.location = "http://alabamaoutdoors.com";</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot