mbarbella@: There are test-only classes in the call stack. I'm unclear about the details of the build being tested, but is it safe to close this bug?

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Might as well keep it open since it would be nice if this didn't crash, but certainly not a security bug (or above Pri-3).

ClusterFuzz has detected this issue as fixed in range 443594:443650.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5702006426828800

Fuzzer: inferno_twister
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: Heap-use-after-free READ 4
Crash Address: 0x2c078497
Crash State:
  base::ObserverListBase<gpu::CommandBufferProxyImpl::DeletionObserver>::begin
  device::MockBluetoothGattNotifySession::DoNotify
  base::internal::Invoker<base::internal::BindState<void
  
Memory Tool: SYZYASAN

Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=441048:441049
Fixed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=443594:443650

Minimized Testcase (0.65 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97Lw6hdsFXT1VRadLFyEXwM0lEBBRxfdAda73V8JPLsGWJipra1RH-IqLZOL7yHe37IGVP-vaCn6xul1aYl3P2CvqSZ-UduZoNeX8m2MeFAflHrBxlM_t4eFwzjZE03yj9LaIYiN-oEgtXWg_FcKLvHoRexDgubaVeWIK9VLxPh9o-_YmAHKWLQHfE12NCr94jeU45MOxIdRWVEjGHVxSpTB1eBaL1B7tVz65sKhADZ7G_IO3f67UxWYcOSCWtxPZJcXTzKaoESnTz2X6zK1Uo1_yMb5Zt1jN_IDsb-cwKjPldlYM2DZpG9Zpm6KzOP1MSvFnKn_4WT78e01ahkPi3WwwePbUfGN6Gh1RsQWAbzJ20D6ew?testcase_id=5702006426828800
  &#x95320;&#x821;<script src=../../resources/testharness.js></script>
<script src=../../resources/testharnessreport.js></script>
<script src=../../resources/bluetooth/bluetooth-helpers.js></script>
<script>
promise_test(() => {
  return setBluetoothFakeAdapter('HeartRateAdapter')
    .then(() => requestDeviceWithKeyDown({
      filters: [{services: ['heart_rate']}]}))
    .then(device => device.gatt.connect())
    .then(gattServer => gattServer.getPrimaryService('heart_rate'))
    .then(service => service.getCharacteristic('heart_rate_measurement'))
    .then(characteristic => {
      return characteristic.startNotifications()
    });
});
</script>


Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5702006426828800 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.