ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=6294507634294784

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=5947060080869376

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=4708967440973824

Thanks for your report. When I'm trying to reproduce the issue, the browser is tries to save 'empty.swf' file and warns me that it can be dangerous. Is it expected behavior? Should I accept it or reject?

After waiting for bing.com page to be loaded (~1-2 minutes), I click on "manipulate ..." button and nothing happens.

Also please notice that Flash is disabled by default: https://blog.google/products/chrome/flash-and-chrome/

empty.swf should be executed. Do you get the alert "Flash required" ?
I updated chrome to version 55 and Flash is still enabled by default.

I forgot to mention that this poc works in Linux too.

In my tests, the browser never tried to save the 'empty.swf' file.

Sorry for the delayed reply. I am able to get the poc running, but clicking the button doesn't lead to a crash for me. Re: comment 4, you may have needed to host this on a web server or run with --allow-file-access-from-files.

Do you have any crash report IDs from chrome://crashes/ related to this, or have a more consistent PoC that leads to the crash? If not, we may not be able to act on this.

This is the crash i get, demonstrating that one of the document remains active (the stack is in the attachment):

0:012> g
(1268.16a8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000001 ebx=00000002 ecx=00000000 edx=00000001 esi=47ee3e30 edi=00000000
eip=6957a22e esp=002bd78c ebp=002bd7a4 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
chrome_child!blink::FrameView::needsLayout [inlined in chrome_child!blink::FrameView::needsLayout]:
6957a22e 8b8194000000    mov     eax,dword ptr [ecx+94h] ds:002b:00000094=????????

Deleted: stack.txt 18.8 KB

stack.txt 18.8 KB View Download

In main.html, if you replace 'sleep(5000)' with 'alert(1)', maybe will it work for you?

Thank you for providing more feedback. Adding requester "mbarbella@chromium.org" for another review and adding "Needs-Review" label for tracking.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Either when running from a local server or with --allow-file-access-from-files, empty.swf is triggering a download for me as well.

+eae: since you're more familiar with this code than me, maybe the repro will make more sense to you?

Unable to reproduce and neither can clusterfuzz. Closing.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot