This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following CL looks like the most likley culprit in the regression range:
https://codereview.chromium.org/2474693002

mlippautz -- Please take a look. Thanks.

Thanks!

We should avoid this undefined behavior cast by having separate dispatchers. Will fix on Monday.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/589b820cd653d34fb6bd3da77f147292b480533e

commit 589b820cd653d34fb6bd3da77f147292b480533e
Author: mlippautz <mlippautz@chromium.org>
Date: Mon Nov 07 16:50:57 2016

[wrapper-tracing] Fix dispatching of TraceWrapperv8Reference

Untangle TraceWrapperV8Reference from ScopedPersistent. This is required as the
combination of vtable and templates makes it impossible to properly cast to the
needed type.

BUG= chromium:662303 

Review-Url: https://codereview.chromium.org/2479133002
Cr-Commit-Position: refs/heads/master@{#430295}

[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/bindings.gni
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/core/v8/ScopedPersistent.h
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/core/v8/ScriptWrappableVisitorTest.cpp
[add] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/core/v8/TraceWrapperV8Reference.h
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.h
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/scripts/v8_callback_function.py
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/templates/callback_function.cpp.tmpl
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/core/AnyCallbackFunctionOptionalAnyArg.cpp
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/core/AnyCallbackFunctionOptionalAnyArg.h
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/core/LongCallbackFunction.cpp
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/core/LongCallbackFunction.h
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/core/StringSequenceCallbackFunctionLongSequenceArg.cpp
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/core/StringSequenceCallbackFunctionLongSequenceArg.h
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/core/VoidCallbackFunction.cpp
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/core/VoidCallbackFunction.h
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/core/VoidCallbackFunctionInterfaceArg.cpp
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/core/VoidCallbackFunctionInterfaceArg.h
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/core/VoidCallbackFunctionTypedef.cpp
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/core/VoidCallbackFunctionTypedef.h
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/modules/VoidCallbackFunctionModules.cpp
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/bindings/tests/results/modules/VoidCallbackFunctionModules.h
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/core/events/PromiseRejectionEvent.cpp
[modify] https://crrev.com/589b820cd653d34fb6bd3da77f147292b480533e/third_party/WebKit/Source/core/events/PromiseRejectionEvent.h

ClusterFuzz has detected this issue as fixed in range 430257:430307.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5057715471908864

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x7ff1da076d40
Crash State:
  Bad-cast to blink::TraceWrapperV8Reference<v8::Value> from blink::TraceWrapperV8Reference<v8::Object>
  blink::reportFatalErrorInMainThread
  v8::Utils::ReportApiFailure
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=429061:429672
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=430257:430307

Minimized Testcase (6.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95wq77Ujs1qOumjUIb1yP85hsp0q5cgfQiDb-V3NysDfFy8q_76olkotdSYLqpcCIWTZrP-V4tZkXg9R30yq8p_PWACpZ4X6ziN_yu0rh7OjxRTeeSzy_ZRkTfKK8jpJrUAjyx5huAT8klAAaFem5302vUWnw?testcase_id=5057715471908864

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot