This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

A friendly reminder that M57 Beta launch is coming soon on February 2nd! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix and get it merged into the release branch (2987) ASAP so it gets enough baking time in Dev (before Beta promotion). Thank you!

robhogan, could you please take a look at this bug? It looks like it's quite possibly related to https://codereview.chromium.org/2329863002. Thanks!

[Bulk edit]

A friendly reminder that M57 Beta launch is coming soon on February 2nd (in a week)! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix and get it merged into the release branch (2987) ASAP so it gets enough baking time in Dev (before Beta promotion). Thank you!

ClusterFuzz testcase 4533190279823360 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/fa2a16567af6fc774c0a9fe44fb53eb5135056b0

commit fa2a16567af6fc774c0a9fe44fb53eb5135056b0
Author: robhogan <robhogan@gmail.com>
Date: Thu Jan 26 19:56:40 2017

Clear out the float-lists from a ruby base when moving its children

A follow up to https://codereview.chromium.org/2329863002 and
https://codereview.chromium.org/2645473004. When moving children from one
base to another clear down the float lists of all descendants - seems like
'it's the only way to be sure'.

BUG= 683104 

Review-Url: https://codereview.chromium.org/2653113002
Cr-Commit-Position: refs/heads/master@{#446410}

[add] https://crrev.com/fa2a16567af6fc774c0a9fe44fb53eb5135056b0/third_party/WebKit/LayoutTests/fast/block/float/rubybase-children-moved-crash-2-expected.txt
[add] https://crrev.com/fa2a16567af6fc774c0a9fe44fb53eb5135056b0/third_party/WebKit/LayoutTests/fast/block/float/rubybase-children-moved-crash-2.html
[modify] https://crrev.com/fa2a16567af6fc774c0a9fe44fb53eb5135056b0/third_party/WebKit/Source/core/layout/LayoutRubyBase.cpp

Please mark security bugs as fixed as soon as the fix lands, and before requesting merges. This update is based on the merge- labels applied to this issue. Please reopen if this update was incorrect.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Your change meets the bar and is auto-approved for M57. Please go ahead and merge the CL to branch 2987 manually. Please contact milestone owner if you have questions.
Owners: amineer@(clank), cmasso@(bling), ketakid@(cros), govind@(desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Please merge  your change to M57 branch 2987 ASAP.If merge happens today before 5:00 PM PT, then we can take it for tomorrow's last M57 Dev release. Thank you.

Has the fix been verified on canary yet?

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/47603830c84360e6074df0d3e6b1c74f99a4bd3a

commit 47603830c84360e6074df0d3e6b1c74f99a4bd3a
Author: Robert Hogan <robhogan@gmail.com>
Date: Mon Jan 30 19:46:01 2017

Clear out the float-lists from a ruby base when moving its children

A follow up to https://codereview.chromium.org/2329863002 and
https://codereview.chromium.org/2645473004. When moving children from one
base to another clear down the float lists of all descendants - seems like
'it's the only way to be sure'.

BUG= 683104 

Review-Url: https://codereview.chromium.org/2653113002
Cr-Commit-Position: refs/heads/master@{#446410}
(cherry picked from commit fa2a16567af6fc774c0a9fe44fb53eb5135056b0)

Review-Url: https://codereview.chromium.org/2659303004 .
Cr-Commit-Position: refs/branch-heads/2987@{#173}
Cr-Branched-From: ad51088c0e8776e8dcd963dbe752c4035ba6dab6-refs/heads/master@{#444943}

[add] https://crrev.com/47603830c84360e6074df0d3e6b1c74f99a4bd3a/third_party/WebKit/LayoutTests/fast/block/float/rubybase-children-moved-crash-2-expected.txt
[add] https://crrev.com/47603830c84360e6074df0d3e6b1c74f99a4bd3a/third_party/WebKit/LayoutTests/fast/block/float/rubybase-children-moved-crash-2.html
[modify] https://crrev.com/47603830c84360e6074df0d3e6b1c74f99a4bd3a/third_party/WebKit/Source/core/layout/LayoutRubyBase.cpp

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label.