This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

https://skia.googlesource.com/skia/+/915817b940b05882d85c220d2b2dc18ef184a6b4 touched the affected file.

Testcase 4658978423570432 is a top crash on ClusterFuzz for linux platform. Please prioritize fixing this crash.

Marking this crash as a Beta release blocker.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/fa8bc34f2884655c7699ae60e4c6536ac86ddecb

commit fa8bc34f2884655c7699ae60e4c6536ac86ddecb
Author: Yuqian Li <liyuqian@google.com>
Date: Thu Dec 28 15:23:00 2017

Fix bug of a + (b - a) == 0 for small positive b and huge a (e.g., 1e18)

I am unable to make a MSAN build to work locally. But I think that this
should fix the problem by looking at the gradient of the fuzzer:

Z.createRadialGradient(1.94159387872, 138.616510533, 2.22085316544e+18,
		       10.3399911492, 176.149195942, 153.078363987);

Bug:  chromium:797184 
Change-Id: I16c571a378742c4ef50afe9c5baba791da7fc208
Reviewed-on: https://skia-review.googlesource.com/89541
Commit-Queue: Yuqian Li <liyuqian@google.com>
Reviewed-by: Greg Daniel <egdaniel@google.com>

[modify] https://crrev.com/fa8bc34f2884655c7699ae60e4c6536ac86ddecb/src/shaders/gradients/SkTwoPointConicalGradient_gpu.cpp

ClusterFuzz has detected this issue as fixed in range 526305:526310.

Detailed report: https://clusterfuzz.com/testcase?key=4658978423570432

Fuzzer: inferno_canvas_wrecker
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  SkMatrix::postConcat
  TwoPointConicalEffect::Data::Data
  Gr2PtConicalGradientEffect::Make
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=525781:525806
Fixed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=526305:526310

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4658978423570432

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4658978423570432 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot