This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

A friendly reminder that M57 Beta launch is coming soon on February 2nd! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix and get it merged into the release branch (2987) ASAP so it gets enough baking time in Dev (before Beta promotion). Thank you!

alancutter, could you take a look at this security bug and see if it could possibly be related to https://codereview.chromium.org/2630503002? Thanks!

This is fixed by https://codereview.chromium.org/2649903005.
Request to merge https://chromium.googlesource.com/chromium/src/+/a6de90795ea5ee5c080e3266dceedd98f66b045e to 57.

ClusterFuzz has detected this issue as fixed in range 445327:445343.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5642947820519424

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Stack-use-after-scope READ 8
Crash Address: 0x7fe649321730
Crash State:
  blink::PropertyRegistry::registration
  blink::CSSInterpolationType::maybeConvertUnderlyingValue
  blink::InvalidatableInterpolation::maybeConvertUnderlyingValue
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=445058:445150
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=445327:445343

Minimized Testcase (0.16 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96IeajsJWaIYVFr_LPZ_FE5G6Z3QJ4ImDSOG2Kb5ynwtVhNX8sNYr6dIi8c4IjfW7K2lOu3H8X0TGqTrd8aMOUy8brBFfhX71emHX58bFcbfEmqLWIA3Mr74Nk_PX3Rr36HNKy7iQAryrKEhYmED69FDBmMiK-_Es030uABFZKoZ0yELtjsJokMWL9NhhUuYNJcb9Z4QqwT5vchCPWOfQsWWZLRmCuVlKxa9WMSf6Q2kXPo3mD0Li7KhT9c-yKwCV71bd9NOohp-JR1YOYhoA9f-CLsszjL5XuDC87khfkld_XcVI5owDzpCpi135ZoYSfpzJpZgjNtRk6SrVR9QoFwD_vhs1fN_2gihQK12oulbFhKNWA?testcase_id=5642947820519424
<style>
@keyframes test {
  to { --x: to; }
}
#target {
  animation: test 1s;
</style>
<div id="target"><script>
CSS.registerProperty({
  name: '--x'});
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5642947820519424 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Your change meets the bar and is auto-approved for M57. Please go ahead and merge the CL to branch 2987 manually. Please contact milestone owner if you have questions.
Owners: amineer@(clank), cmasso@(bling), ketakid@(cros), govind@(desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/269942eb79516fad019284211999bc92d382c138

commit 269942eb79516fad019284211999bc92d382c138
Author: Alan Cutter <alancutter@chromium.org>
Date: Wed Jan 25 01:52:46 2017

blink: fix use-after-scope issues in CSSInterpolationType.

The problem was in the following line:

const AtomicString& propertyName = getProperty().customPropertyName();
<consequent use of propertyName>

getProperty() returns PropertyHandle value that is allocated on
the stack as a temporary variable with the scope of one statement.
Then customPropertyName() returns a reference to this temp variable.
Once the statement is over, PropertyHandle value goes out of scope
and destroyed. By the time propertyName is used, it already points
to a potentially reused stack address. And even if it's not yet
reused, the object is destroyed, so the value is invalid anyway.

The fix is to save ProperyHandle value in a local variable with
the large enough scope to cover all propertyName uses.

The bug was found by AddressSanitizer with use-after-free check
enabled. It's currently being rolled out into Chrome, and this CL
is a part of a larger cleanup of existing failures.

BUG= 649897 , 683459 , 683493 

Review-Url: https://codereview.chromium.org/2649903005
Cr-Commit-Position: refs/heads/master@{#445559}
(cherry picked from commit a6de90795ea5ee5c080e3266dceedd98f66b045e)

Review-Url: https://codereview.chromium.org/2655663005 .
Cr-Commit-Position: refs/branch-heads/2987@{#79}
Cr-Branched-From: ad51088c0e8776e8dcd963dbe752c4035ba6dab6-refs/heads/master@{#444943}

[modify] https://crrev.com/269942eb79516fad019284211999bc92d382c138/third_party/WebKit/Source/core/animation/CSSInterpolationType.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/13f2e28123b749889096143c033a79307510a3aa

commit 13f2e28123b749889096143c033a79307510a3aa
Author: alancutter <alancutter@chromium.org>
Date: Wed Jan 25 05:54:48 2017

Make PropertyHandle instances const references where possible

This change cleans up usage patterns of PropertyHandles to better reflect
the fact that it holds ownership over an AtomicString.
Previously PropertyHandles used to be the CSSPropertyID enum where it
was normal to pass by copy all the time.
This change helps avoid Stack-use-after-scope errors when using
returned PropertyHandles.

BUG= 683493 

Review-Url: https://codereview.chromium.org/2649103007
Cr-Commit-Position: refs/heads/master@{#445963}

[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/EffectModel.h
[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/Interpolation.h
[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/InterpolationEffect.cpp
[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/InterpolationEffect.h
[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/InvalidatableInterpolation.h
[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/Keyframe.cpp
[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/Keyframe.h
[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/KeyframeEffectModel.h
[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/LegacyStyleInterpolation.cpp
[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/LegacyStyleInterpolation.h
[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/StringKeyframe.cpp
[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/StringKeyframe.h
[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/animatable/AnimatableValueKeyframe.cpp
[modify] https://crrev.com/13f2e28123b749889096143c033a79307510a3aa/third_party/WebKit/Source/core/animation/animatable/AnimatableValueKeyframe.h

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot