This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

+jochen@, could you take a look to see if this is related to your recent change https://codereview.chromium.org/2769283004?  

Please feel free to re-assign.

why would that be related to that change?

this just looks like we have the RELEASE_ASSERT() in HTMLFrameElementBase.cpp - no idea why the bot then freaks out about type confusion.

for the check, see  issue 631151 

Assigning back to figure out why the release assert doesn't terminate the process

ClusterFuzz has detected this issue as fixed in range 460063:460114.

Detailed report: https://clusterfuzz.com/testcase?key=6478628205625344

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x7f90cf548470
Crash State:
  Bad-cast to sandbox::bpf_dsl::(anonymous namespace)::ReturnResultExprImpl from invalid vptr
  blink::HTMLFrameElementBase::didNotifySubtreeInsertionsToDocument
  blink::ContainerNode::insertNodeVector<>
  
Sanitizer: cfi (CFI)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=459433:459517
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=460063:460114

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv94VnYKFc8r7MUEE9sekN7H6JJuaVJUeCDFIUjh0FOQtvJoQUFh7icCvbLMiJMf3AGTO3TyoGEXknT5ZeaxCPYm_enQrYmcLjI0bXS0w6nqsci_EX5dnNgycAcH1AX-7Furo0uwjzt51qGUW7DhKpmfs6LAf0OZBmHonAs-HXgbx0skq-_xpNaQG__NzVZyp26UwDjxhQzJ8tY6U4n_2ViAiMBviSQLiLe8a3nM8GmXUtmw0jNF14RqKcvA9cJP4Gn6TQ8BtByS0pGUougoc2x_Jj1iTY5rKVQa3s_wOR6A8pY1zm7jByPbSZUnGDF4jViSrBbgYgoltPkluBWfTSLFEr-v9_3SF0gJcd1-pYAlvTKS9zHoCDCkS1yPTLUmhtcnfvYHDXQ3k4VYmLC6XOjTpQG7_WA?testcase_id=6478628205625344


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6478628205625344 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot