haraken -- Can you triage this or find an appropriate owner?  Thanks

keishi@: Would you mind taking a look?

~ColorChooserUIController seems to be accessing another on-heap object.

ClusterFuzz has detected this issue as fixed in range 445298:445299.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6554868631470080

Fuzzer: inferno_twister
Job Type: linux_ubsan_vptr_content_shell_drt
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x2197d89f0228
Crash State:
  Bad-cast to test_runner::WebTestDelegatetest_runner::MockColorChooser::endChooser
  blink::ColorChooserUIController::~ColorChooserUIController
  blink::NormalPage::sweep
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=443512:443559
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=445298:445299

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv959SaMinx0TH0osqb2DBw1FXAqhdHz7YtyIzuyijd1HCuvtkpwlli7MV8jDrN1utAEt5CzBqQ25aAJuAaiR1-adYc889KQIAgNxhFtp9op7InErU9SyoEfGAkwyMpsEewKanJVIHJlea-SCyNBbksHon1FaADL3IHjnYKJFIOOGDf7XL2WoV0mIrzkmHfyPcp1LtElmJuoENx_fbkx3q6xW5a1x0w6C9oDmgWwDBqekyqmu2m3w0GvcWeypeGs7Ecn3iMpRM2eQaL5bxgXr7iNpXc97z03yf-NFfcL7L_ZOS7DtnE4SsKlLb1Uhqdjbbd1JigyFFdVfZoK-hmdlCCnz9Jpc3DBHO7ykOU8iGLodqMQZZ3Y?testcase_id=6554868631470080


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Looks like the access to MockColorChooser::delegate_ in MockColorChooser::endChooser  is a use-after-free since it WebTestDelegate is destroyed before ColorChooserUIController is swept.

I've created a CL that attempts to fix this but I cannot reproduce the problem locally so I can't confirm the fix.
https://codereview.chromium.org/2648123003/

Anyway this bug is limited to tests.

Same as  issue 670965 , i guess. Fuzzer is a bit too keen on marking invariably flaky tests as no longer reproducing.

ClusterFuzz testcase 6554868631470080 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot