This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This is a UAF in the browser process, so I'm keeping the severity level suggested by clusterfuzz (critical).

gavinp: Can you please take a look and reassign if appropriate?

On it. TY.

Oops, wrong severity. ipc fuzzers assume a compromised renderer so this is only high.

Moving to ReleaseBlock-Stable so this still gets tracked in the milestone

This has been dogging SyzyASAN canaries since Nov 9. See bug 663589.

note since this hasn't been updated in awhile, also see https://bugs.chromium.org/p/chromium/issues/detail?id=663589#c14

We commit ourselves to a 60 day deadline for fixing for high severity vulnerabilities, and have exceeded it here. If you're unable to look into this soon, could you please find another owner or remove yourself so that this gets back into the security triage queue?

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Closing this as a dup; merging it into the existing issue for the shader cache

Reassigning to myself, along with the dup.

ClusterFuzz has detected this issue as fixed in range 454233:454289.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5198168703893504

Fuzzer: ipc_fuzzer_gen
Job Type: mac_asan_chrome_ipc
Platform Id: mac

Crash Type: Heap-use-after-free WRITE 8
Crash Address: 0x6060008940a8
Crash State:
  disk_cache::BackendImpl::SyncOpenNextEntry
  disk_cache::BackendIO::ExecuteBackendOperation
  base::debug::TaskAnnotator::RunTask
  
Sanitizer: address (ASAN)

Recommended Security Severity: Critical

Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome_ipc&range=432166:432259
Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome_ipc&range=454233:454289

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94ELlJEMlk1g028IZn9gj-L39s_zG6FfBhaLjUWu42KMx4Su1fbYfdiPEdmTsGTI1EKSQCwtLv6bwM7iixTASY29CnrlDn7jkfxmKz3L5az8_pnMjBVIRGHHRhAXnpstXFZegADsPQDn2T1pHk8Fxh7a_kBnmzNIeBZfsuDiJATssrj1DY?testcase_id=5198168703893504


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot