This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

reed@, this stacktrace is winding up in auto generated assembly code in Skia, which is outside of my expertise, so would you mind helping route this bug? Thank you.

ClusterFuzz has detected this issue as fixed in range 488849:488981.

Detailed report: https://clusterfuzz.com/testcase?key=6375948386828288

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_asan_chrome_media
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x7f0d2cef1ff8
Crash State:
  _sk_gather_bgra_avx
  SkBlitter::blitRect
  antifilldot8
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_media&range=488410:488479
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_media&range=488849:488981

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6375948386828288


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6375948386828288 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

ClusterFuzz has detected this issue as fixed in range 488849:488981.

Detailed report: https://clusterfuzz.com/testcase?key=6375948386828288

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_asan_chrome_media
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x7f0d2cef1ff8
Crash State:
  _sk_gather_bgra_avx
  SkBlitter::blitRect
  antifilldot8
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_media&range=488410:488479
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_media&range=488849:488981

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6375948386828288


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Hi reed@ - looks like the fix range is in 62, is there anything identified we could merge to 61?

Probably the same as 749260.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot