This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=6277982919589888

Detailed report: https://clusterfuzz.com/testcase?key=6488465509449728

Fuzzer: ifratric-browserfuzzer-v3
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 
Crash State:
  blink::PrePaintTreeWalkContext::PrePaintTreeWalkContext
  blink::PrePaintTreeWalk::Walk
  blink::PrePaintTreeWalk::Walk
  
Memory Tool: SYZYASAN

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv94au11_YffxFKLBuSPNgYMTge2fqdEcOpNjo6n6MUEvddKJvJy1k2nRB7-Gyz53LNU6t7JdlQ1bHq1STbM0PRIVHgzAjep33dkxrzDxbZ3w2jRdjbrm9iI9FG1j49Wrv9zLbgZBpXL0ThF04wI6hI0GKzFuJSJ34CFYK7wyM267FZq9A9f-HzxLgYah3K1NH0XizhJXlmqfiSBpuEatFvLk12eNYNluUdraXD8IXD6GsIjReHt-pB8OgZKzxm9pX0xGaoQqUsse-v5rnPAwoOoCsL3Z7wech5lDdT0d-iy9YIVwUe4dopD_E7rbBqMbQFmwTp7i818XUaTlcjmPe_vh1Q4C56km2BtS-yCZwhw8GZPY2lc?testcase_id=6488465509449728


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

I'm a bit mystified by this one. +various paint owners to triage please.

ClusterFuzz has detected this issue as fixed in range 465383:465417.

Detailed report: https://clusterfuzz.com/testcase?key=4567832907218944

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x7f14185c02c0
Crash State:
  Bad-cast to sandbox::bpf_dsl::(anonymous namespace)::ReturnResultExprImpl from invalid vptr
  blink::PrePaintTreeWalkContext::PrePaintTreeWalkContext
  blink::PrePaintTreeWalk::Walk
  
Sanitizer: cfi (CFI)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=462616:462692
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=465383:465417

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv9569o8Afx_tqalGk8TgRtYMkUkMfSrFrAfLBDn1xqgdgA9sMifc-pf42t5Tilms5cwIT8hE02HNA4UvUARgyFmjZKO9WoowE9pqgrtiTDPB1xXPm1q7y93YDD1ghqw10DWEDHmMVCn79V97GtyzKEOt3bJg6ci8bSaYhpk7DqfIDbNrPpHST28RfgRx_8cOFWfmB_9z_2wdcfyTsAnj7MpqiPTCWwBzMk9QLaHUH00r0EHOAvY_BnhtO1c9dD8PY7IUZcW3IgoNGl4v7vn2X-YQMoedRB6leBjbLev-Qcjv4g8tziM-tkKxEfVk-oPVzn0iUc19zh0w-mgOhHq4z3oTVmEPzzkqjqPcJlBDMXV32FhdQLw?testcase_id=4567832907218944


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 465403:465445.

Detailed report: https://clusterfuzz.com/testcase?key=6488465509449728

Fuzzer: ifratric-browserfuzzer-v3
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 
Crash State:
  blink::PrePaintTreeWalkContext::PrePaintTreeWalkContext
  blink::PrePaintTreeWalk::Walk
  blink::PrePaintTreeWalk::Walk
  
Memory Tool: SYZYASAN

Regressed: https://clusterfuzz.com/revisions?job=windows_syzyasan_chrome&range=461871:461894
Fixed: https://clusterfuzz.com/revisions?job=windows_syzyasan_chrome&range=465403:465445

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv94au11_YffxFKLBuSPNgYMTge2fqdEcOpNjo6n6MUEvddKJvJy1k2nRB7-Gyz53LNU6t7JdlQ1bHq1STbM0PRIVHgzAjep33dkxrzDxbZ3w2jRdjbrm9iI9FG1j49Wrv9zLbgZBpXL0ThF04wI6hI0GKzFuJSJ34CFYK7wyM267FZq9A9f-HzxLgYah3K1NH0XizhJXlmqfiSBpuEatFvLk12eNYNluUdraXD8IXD6GsIjReHt-pB8OgZKzxm9pX0xGaoQqUsse-v5rnPAwoOoCsL3Z7wech5lDdT0d-iy9YIVwUe4dopD_E7rbBqMbQFmwTp7i818XUaTlcjmPe_vh1Q4C56km2BtS-yCZwhw8GZPY2lc?testcase_id=6488465509449728


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4567832907218944 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot