This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz has detected this issue as fixed in range 441524:442831.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4921535539445760

Fuzzer: inferno_twister
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  cc::SurfaceFactory::EvictSurface
  cc::CompositorFrameSinkSupport::~CompositorFrameSinkSupport
  content::OffscreenCanvasCompositorFrameSink::~OffscreenCanvasCompositorFrameSink
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_content_shell_drt&range=438562:438656
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_content_shell_drt&range=441524:442831

Minimized Testcase (0.14 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv978sLEb7LRpObVchtU3nI2TNlwZk9AXDxzxUZXMVCj2HiaFlbXL729wKxbPQHhq6jby-KubYQ9Yw8CtqPU_FNjyctgvldhn_uYUrIDfn3hHAHWfw2gHwC1Q64jAWcrB60jFKd6erzjBR5mMrNchCaZ3z8XCVA?testcase_id=4921535539445760
<canvas id=c><script>
var can = document.getElementById('c');
var ctx = can.transferControlToOffscreen().getContext("2d");
ctx.commit();
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot