The result is a list of CLs that change the crashed files.

Author: fs
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/d36f8a8c9c4b7d757c0d8832e624be80c4465991
Time: Tue Nov 08 08:48:09 2016
Lines 58 of file PaintLayerFilterInfo.cpp which potentially caused crash are changed in this cl (frame #1, "blink::PaintLayerFilterInfo::resourceElementChanged").

Files Element.cpp, SVGElementProxy.cpp are changed in this cl (and is part of stack frame #4, "updateId"; frame #5, "updateId"; frame #6, "blink::Element::didRemoveAttribute")
Minimum distance from crash line to modified line: 0. (file: PaintLayerFilterInfo.cpp, crashed on: 56, modified: 56).

Suspected Project: chromium
Suspected Component: Blink>SVG

This is Fredrik's recent change. I'll let him make the call to roll out or fix.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/11759c7f36706a115c03b9fc98a6060dd73a71e9

commit 11759c7f36706a115c03b9fc98a6060dd73a71e9
Author: pdr <pdr@chromium.org>
Date: Wed Nov 09 00:50:20 2016

Revert of Tracking filter mutation via SVGElementProxy (patchset #15 id:280001 of https://codereview.chromium.org/2401343002/ )

Reason for revert:
There are several reports of issues from this patch. Lets go ahead and roll out for now.

BUG= 663362 , 663444 , 663473 , 663362 

Original issue's description:
> Tracking reference filter mutation via SVGElementProxy
>
> This introduces SVGElementProxy - a new piece with the functionality of
> DocumentResourceReference and the ReferenceFilterBuilder merged. It
> provides the means to track clients of a certain element (only
> SVGFilterElements for now, but will likely be extended to other types if
> it ends up sticking.) An SVGElementProxy is created, and primarily owned,
> by CSSURIValue. The proxy also handles loading of a resource document, if
> requested.
>
> Clients are SVGResourceClients, like before, with methods/callbacks
> renamed. Some of the old functionality of SVGResourceClient has either
> been moved to clients, to the proxy or been replaced with different
> solutions.
>
> Mutations to the element/subtree is signaled separately from any
> potential changes to the actual reference (anything that might invalidate
> the element reference.)
>
> BUG= 439970 
> CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
>
> Committed: https://crrev.com/d36f8a8c9c4b7d757c0d8832e624be80c4465991
> Cr-Commit-Position: refs/heads/master@{#430550}

TBR=esprehn@chromium.org,fs@opera.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

BUG= 439970 , 663362 , 663444 , 663473 , 663362 

Review-Url: https://codereview.chromium.org/2482353002
Cr-Commit-Position: refs/heads/master@{#430800}

[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/css/CSSURIValue.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/css/CSSURIValue.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/css/resolver/ElementStyleResources.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/css/resolver/ElementStyleResources.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/css/resolver/FilterOperationResolver.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/dom/Document.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/dom/Document.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/dom/Element.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/dom/Element.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/dom/Node.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/dom/Node.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/dom/StyleChangeReason.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/dom/StyleChangeReason.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/fetch/BUILD.gn
[add] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/fetch/DocumentResourceReference.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/frame/FrameView.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/layout/svg/BUILD.gn
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceContainer.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceContainer.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceFilter.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceFilter.h
[add] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/layout/svg/ReferenceFilterBuilder.cpp
[add] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/layout/svg/ReferenceFilterBuilder.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/paint/FilterEffectBuilder.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/paint/PaintLayer.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/paint/PaintLayer.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/paint/PaintLayerFilterInfo.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/paint/PaintLayerFilterInfo.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/style/FilterOperation.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/style/FilterOperation.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/style/FilterOperations.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/style/FilterOperations.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/svg/BUILD.gn
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.h
[delete] https://crrev.com/b9b22b4b813671b5e461333a8bdfebcb1740a97e/third_party/WebKit/Source/core/svg/SVGElementProxy.cpp
[delete] https://crrev.com/b9b22b4b813671b5e461333a8bdfebcb1740a97e/third_party/WebKit/Source/core/svg/SVGElementProxy.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/svg/SVGFilterElement.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/svg/SVGFilterElement.h
[add] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/svg/SVGResourceClient.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/core/svg/SVGResourceClient.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.h
[modify] https://crrev.com/11759c7f36706a115c03b9fc98a6060dd73a71e9/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2DState.cpp

ClusterFuzz has detected this issue as fixed in range 430773:430834.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6474770188337152

Fuzzer: inferno_twister
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000010
Crash State:
  layoutObject
  blink::PaintLayerFilterInfo::resourceElementChanged
  blink::SVGElementProxy::IdObserver::idTargetChanged
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=430516:430550
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=430773:430834

Minimized Testcase (1.19 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95-8t4XpCsmqTLDikTm6xrPv46rSpUbIvEeLQmFWLA0bhCP6H5nKbha84pjIS9w-nX0rI98oV0bstK_9Y4yxIQlGk5YPrRDBiv0pf6RtbqLjQPeoAqU1dRwfQvoO-okRG2YXkx0rDcg1PnY6QwtfPGgM03Ndg?testcase_id=6474770188337152

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot