Findit cannot find any culprit results.

assigning to /src/third_party/WebKit/Source/wtf/OWNERS, requesting to check the issue and help.

This looks like a bug in blobs where it's asking us to make a Vector that's too big?

dmurph@ - can you look?

It looks like that test tries to make a 2 gigabyte file object?

shouldBe("new File([new Int16Array(2147483476)], 'world.html').size");

What are we expecting here?

 Issue 656539  for the same, but then with a RELEASE_ASSERT().

It looks like we will throw (rather than OOM/crash) some operations (e.g. TypedArray ctors) if there's insufficient memory. If there's a point during the Blob/File lifecycle where that makes sense we could do something similar.

E.g. when we try and make a copy of the bytes during the construction we could check available memory first and throw.

This would be unspec'd behavior, but we know where the spec editor is so we could propose it.

 Issue 694745  has been merged into this issue.

ClusterFuzz testcase 5826146647408640 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

ClusterFuzz has detected this issue as fixed in range 471041:471079.

Detailed report: https://clusterfuzz.com/testcase?key=5590039158587392

Fuzzer: inferno_twister
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: CHECK failure
Crash Address: 
Crash State:
  count <= maxElementCountInBackingStore<T>() in PartitionAllocator.h
  void WTF::Vector<char, 0ul, WTF::PartitionAllocator>::append<char>
  blink::BlobData::appendBytes
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=447465:447478
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=471041:471079

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5590039158587392


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.