ortuno @ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !

Yay, the fuzzer finally found a bug! The problem is that readValue/writeValue calls should keep the characteristic as a Persistent rather than a WeakPersistent. Otherwise the characteristic could get garbage collected during the gatt operation. WIP patch at http://crrev.com/2465823002 Still missing tests.

 Issue 660885  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/35d4f33d891b86e982d9f010285fc71937de3bf2

commit 35d4f33d891b86e982d9f010285fc71937de3bf2
Author: ortuno <ortuno@chromium.org>
Date: Thu Nov 03 01:58:06 2016

bluetooth: Make BluetoothRemoteGATTCharacteristic Persistent

Since it was WeakPersistent the characteristic was getting garbage
collected which lead to a crash when the response arrived. Also adds tests for
all the relevant functions.

BUG= 659182 

Review-Url: https://codereview.chromium.org/2465823002
Cr-Commit-Position: refs/heads/master@{#429509}

[modify] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/TestExpectations
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/connect/garbage-collection-ran-during-error.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/connect/garbage-collection-ran-during-success.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/getCharacteristic/gen-characteristic-garbage-collection-ran-during-error.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/getCharacteristic/gen-characteristic-garbage-collection-ran-during-success.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/getCharacteristics/gen-characteristic-garbage-collection-ran-during-error-with-uuid.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/getCharacteristics/gen-characteristic-garbage-collection-ran-during-error.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/getCharacteristics/gen-characteristic-garbage-collection-ran-during-success-with-uuid.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/getCharacteristics/gen-characteristic-garbage-collection-ran-during-success.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/getPrimaryService/gen-service-garbage-collection-ran-during-error.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/getPrimaryService/gen-service-garbage-collection-ran-during-success.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/getPrimaryServices/gen-service-garbage-collection-ran-during-error-with-uuid.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/getPrimaryServices/gen-service-garbage-collection-ran-during-error.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/getPrimaryServices/gen-service-garbage-collection-ran-during-success-with-uuid.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/getPrimaryServices/gen-service-garbage-collection-ran-during-success.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/readValue/gen-gatt-op-garbage-collection-ran-during-error.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/readValue/gen-gatt-op-garbage-collection-ran-during-success.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/script-tests/characteristic-garbage-collection-ran-during-error.js
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/script-tests/characteristic-garbage-collection-ran-during-success.js
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/script-tests/gatt-op-garbage-collection-ran-during-error.js
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/script-tests/gatt-op-garbage-collection-ran-during-success.js
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/script-tests/service-garbage-collection-ran-during-error.js
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/script-tests/service-garbage-collection-ran-during-success.js
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/startNotifications/gen-gatt-op-garbage-collection-ran-during-error.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/startNotifications/gen-gatt-op-garbage-collection-ran-during-success.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/stopNotifications/gen-gatt-op-garbage-collection-ran-during-success.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/writeValue/gen-gatt-op-garbage-collection-ran-during-error.html
[add] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/LayoutTests/bluetooth/writeValue/gen-gatt-op-garbage-collection-ran-during-success.html
[modify] https://crrev.com/35d4f33d891b86e982d9f010285fc71937de3bf2/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTCharacteristic.cpp

ClusterFuzz has detected this issue as fixed in range 429506:429524.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4832550301466624

Fuzzer: ortuno_web_bluetooth_fuzzer
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000058
Crash State:
  blink::ReadValueCallback::onError
  content::WebBluetoothImpl::OnReadValueComplete
  void base::internal::FunctorTraits<void
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=427006:427199
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=429506:429524

Minimized Testcase (10.92 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94buP9H5mqO7hg8Jri_1b582Gi11aUhpc1xsCRqLnq1lvO757bx6MQ0Rc-6v22iMN9f8lEN0ahSQOIQ8BDksB1MFeanZuBmB309HW0XTJyvbeNagiP_w3ohZZZ1hbMPzJ8CdK2Lvv5GFgo3zfdhC_hMhQ2gkw?testcase_id=4832550301466624

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot