Author: eae
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/fdcbab80bc37108f6e03d6906f27831228690350
Time: Fri Oct 14 19:47:55 2016
Lines 417-418, 425 of file SVGLengthContext.cpp which potentially caused crash are changed in this cl (frame #4, "blink::SVGLengthContext::convertValueFromEXSToUserUnits").

File ComputedStyle.cpp is changed in this cl (and is part of stack frame #3, "blink::ComputedStyle::font")
Minimum distance from crash line to modified line: 0. (file: SVGLengthContext.cpp, crashed on: 417, modified: 417).

Suspected Project: chromium
Suspected Component: Blink>SVG

Fix has already landed, r427080.

ClusterFuzz has detected this issue as fixed in range 427006:427174.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5333309796384768

Fuzzer: inferno_twister
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000040
Crash State:
  blink::ComputedStyle::font
  blink::SVGLengthContext::convertValueFromEXSToUserUnits
  blink::SVGLengthContext::convertValueToUserUnits
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=425398:425442
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=427006:427174

Minimized Testcase (7.52 Kb): https://cluster-fuzz.appspot.com/download/AMIfv947TjdEUI3sIhbSwr1zv3gpVzNv4S1FHM311_7kF8yksBNVxrpBFNUtPxJARNT2yeAzabedBbYO8gannxyCmd0q6R9Buxib25JhsaXw0eRO5xqG03or1U6_v-pP-G2LDEw3mS1KVhajZpDu_OTVoJ6AkdCflA?testcase_id=5333309796384768

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot