The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2f5940ae12c373666ff2ccf74eed847aaa351987

commit 2f5940ae12c373666ff2ccf74eed847aaa351987
Author: Vladimir Levin <vmpstr@chromium.org>
Date: Fri Aug 11 18:01:05 2017

cc/paint: Validate shaders during deserialization.

This patch ensures that we run basic sanity validation on deserialized
shaders.

R=enne@chromium.org

Bug:  754086 ,  753618 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Icb6448c687488e09efb3b5110cc8bebe37fc7025
Reviewed-on: https://chromium-review.googlesource.com/610938
Commit-Queue: Vladimir Levin <vmpstr@chromium.org>
Reviewed-by: Florin Malita <fmalita@chromium.org>
Reviewed-by: enne <enne@chromium.org>
Cr-Commit-Position: refs/heads/master@{#493805}
[modify] https://crrev.com/2f5940ae12c373666ff2ccf74eed847aaa351987/cc/paint/paint_op_reader.cc
[modify] https://crrev.com/2f5940ae12c373666ff2ccf74eed847aaa351987/cc/paint/paint_shader.cc
[modify] https://crrev.com/2f5940ae12c373666ff2ccf74eed847aaa351987/cc/paint/paint_shader.h

 Issue 753618  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 493780:493839.

Detailed report: https://clusterfuzz.com/testcase?key=5141583694659584

Fuzzer: libFuzzer_paint_op_buffer_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000028
Crash State:
  cc::PaintOpBuffer::Playback
  cc::ToSkPicture
  cc::PaintShader::GetSkShader
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=491858:491939
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=493780:493839

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5141583694659584

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6569444632690688 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.