Assigning to vmpstr@ as https://chromium.googlesource.com/chromium/src/+/06970f10e5aab4e7b49196a335f9fbca1df5fa16 has been identified as a culprit CL.

Forgot to actually assign the issue.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This code is all behind a command line flag so is disabled by default.

ClusterFuzz has detected this issue as fixed in range 518493:518517.

Detailed report: https://clusterfuzz.com/testcase?key=6443611003813888

Fuzzer: libFuzzer_paint_op_buffer_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  sk_fopen
  mmap_filename
  SkStream::MakeFromFile
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=515053:515085
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=518493:518517

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6443611003813888

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6443611003813888 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This was closed due to changes from https://chromium-review.googlesource.com/770522.  I think this is still a real issue that needs to be fixed, so I'm reopening this.  Please repro from older Chrome versions.

vmpstr@ do you think this crash can still be reached?
If you think it isn't reachable anymore, feel free to close.

I suspect if it were reachable, the fuzzer would have found a way to trigger it by now.

I think we can WontFix this now.  The fuzzer hasn't refound it and we're going to remove this path.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot