This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I cannot see any details in the clusterfuzz report. CC mbarbella@.

Sounds similar to an issue that Tanin was looking into earlier. Not sure if it's expected to be resolved yet.

XFA -> not shipping.

thestig: Thanks for the correction! 

dsinclair: Assigning to you so that we have an owner for this bug.

Adjusting the flags (impact to none, reassign severity as medium)

Ah, thanks.

FXJSE_ assuming again any V8 object with internal fields is one of its own.  I'll take a look at what we did on the FXJS_ side the last time we hit this on monday.

ClusterFuzz has detected this issue as fixed in range 465929:466779.

Detailed report: https://clusterfuzz.com/testcase?key=4980637548412928

Fuzzer: libfuzzer_pdfium_xfa_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Heap-buffer-overflow READ 4
Crash Address: 0x6090000cd080
Crash State:
  CXFA_Object::IsNode
  CXFA_Object::AsNode
  ToNode
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=465905:465929
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=465929:466779

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4980637548412928


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4980637548412928 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

tsepez@ is working on this, but the fix isn't committed yet.

See https://pdfium-review.googlesource.com/c/4475/

should actually be fixed in (plus forthcoming roll)

https://pdfium.googlesource.com/pdfium/+/336544a7451ac80c9f33216b7f61e9347d251108

I'm guessing the repro may be sensitive to small perturbations in V8 which may have closed it out prematurely.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label.