This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

aleventhal, could you please take a look? May be related to https://chromium-review.googlesource.com/624069

Hey aleventhal@, Are you still the right person to be looking at this bug? If not, can you reassign it?

@asymmetric, I have a CL for it: https://chromium-review.googlesource.com/c/chromium/src/+/659240 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/af9962ac59c4f922adcd624bd5ed04f310afce76

commit af9962ac59c4f922adcd624bd5ed04f310afce76
Author: Aaron Leventhal <aleventhal@chromium.org>
Date: Mon Sep 11 13:32:36 2017

Allow any table row as the child of an ARIA grid

Bug:  761278 
Change-Id: I5250b356d804fab1a99486635eee6506a912b1d2
Reviewed-on: https://chromium-review.googlesource.com/659240
Reviewed-by: Nektarios Paisios <nektar@chromium.org>
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Cr-Commit-Position: refs/heads/master@{#500904}
[modify] https://crrev.com/af9962ac59c4f922adcd624bd5ed04f310afce76/third_party/WebKit/Source/modules/accessibility/AXARIAGrid.cpp

ClusterFuzz has detected this issue as fixed in range 500892:500924.

Detailed report: https://clusterfuzz.com/testcase?key=5129963706777600

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Security DCHECK failure
Crash Address: 
Crash State:
  !object || (object->IsARIARow()) in AXARIAGridRow.h
  blink::AXARIAGrid::AddRow
  blink::AXARIAGrid::ComputeRows
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=498934:498994
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=500892:500924

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5129963706777600

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5129963706777600 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug requires manual review: M62 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Approving merge for M62. Branch:3202

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/14b5bfa9faa29a6c9169fb0b276db7ba84323af9

commit 14b5bfa9faa29a6c9169fb0b276db7ba84323af9
Author: Aaron Leventhal <aleventhal@chromium.org>
Date: Fri Sep 22 21:07:45 2017

Allow any table row as the child of an ARIA grid

Bug:  761278 
Change-Id: I5250b356d804fab1a99486635eee6506a912b1d2
Reviewed-on: https://chromium-review.googlesource.com/659240
Reviewed-by: Nektarios Paisios <nektar@chromium.org>
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#500904}(cherry picked from commit af9962ac59c4f922adcd624bd5ed04f310afce76)
Reviewed-on: https://chromium-review.googlesource.com/679534
Reviewed-by: Aaron Leventhal <aleventhal@chromium.org>
Cr-Commit-Position: refs/branch-heads/3202@{#408}
Cr-Branched-From: fa6a5d87adff761bc16afc5498c3f5944c1daa68-refs/heads/master@{#499098}
[modify] https://crrev.com/14b5bfa9faa29a6c9169fb0b276db7ba84323af9/third_party/WebKit/Source/modules/accessibility/AXARIAGrid.cpp

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot