Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/8fc86d05d7b0a18c0e4f726f496a0083c6a8a9e6 ([SPv175+] Create OverflowClip for LayoutSVGViewportContainer).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ddf97370fd1d537d17aef25434d6bdb45dfc7511

commit ddf97370fd1d537d17aef25434d6bdb45dfc7511
Author: Xianzhu Wang <wangxianzhu@chromium.org>
Date: Wed Jan 10 16:34:34 2018

Revert "[SPv175+] Create OverflowClip for LayoutSVGViewportContainer"

This reverts commit 8fc86d05d7b0a18c0e4f726f496a0083c6a8a9e6.

Reason for revert: Caused  crbug.com/800692 

Original change's description:
> [SPv175+] Create OverflowClip for LayoutSVGViewportContainer
> 
> A LayoutSVGViewportContainer may clip overflow just like
> a LayoutSVGRoot.
> 
> Bug:  771643 
> Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
> Change-Id: I81d2468a57429542263520a90847645e69080991
> Reviewed-on: https://chromium-review.googlesource.com/858161
> Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
> Reviewed-by: Tien-Ren Chen <trchen@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#528243}

TBR=wangxianzhu@chromium.org,trchen@chromium.org,chrishtr@chromium.org

Change-Id: I882a7e726474cce76fb624b8d77fdb0b23fd9d53
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  771643 ,  800692 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Reviewed-on: https://chromium-review.googlesource.com/860318
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#528338}
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/inner-svg-change-viewBox-contract-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/inner-svg-change-viewBox-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/inner-svg-change-viewPort-relative-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/text-rescale-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/paint/invalidation/svg/paintorder-filtered-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/paint/invalidation/svg/repaint-paintorder-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/platform/linux/paint/invalidation/svg/inner-svg-change-viewPort-relative-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/platform/linux/paint/invalidation/svg/text-rescale-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/platform/mac/paint/invalidation/svg/inner-svg-change-viewPort-relative-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/svg/text-rescale-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/virtual/spv175/paint/invalidation/svg/inner-svg-change-viewBox-contract-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/virtual/spv175/paint/invalidation/svg/inner-svg-change-viewBox-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/virtual/spv175/paint/invalidation/svg/inner-svg-change-viewPort-relative-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/virtual/spv175/paint/invalidation/svg/repaint-paintorder-expected.txt
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/LayoutTests/virtual/spv175/paint/invalidation/svg/text-rescale-expected.txt
[delete] https://crrev.com/d6d188105276e44cf8dfa3d40da10ac3ed400811/third_party/WebKit/LayoutTests/virtual/spv175/paint/invalidation/svg/use-clipped-hit-expected.txt
[delete] https://crrev.com/d6d188105276e44cf8dfa3d40da10ac3ed400811/third_party/WebKit/LayoutTests/virtual/spv175/paint/invalidation/svg/zoom-coords-viewattr-01-b-expected.png
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/Source/core/layout/svg/LayoutSVGViewportContainer.h
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilderTest.cpp
[modify] https://crrev.com/ddf97370fd1d537d17aef25434d6bdb45dfc7511/third_party/WebKit/Source/core/paint/SVGContainerPainter.cpp

ClusterFuzz testcase 5389292447989760 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

ClusterFuzz has detected this issue as fixed in range 528337:528339.

Detailed report: https://clusterfuzz.com/testcase?key=5576396255789056

Fuzzer: bj_broddelwerk
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: Security DCHECK failure
Crash Address: 
Crash State:
  object.IsBox() in LayoutBox.h
  [vdso]
  blink::ObjectPaintPropertyTreeBuilder::UpdateForChildren
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_v8_arm&range=528242:528243
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_v8_arm&range=528337:528339

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5576396255789056

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

The older reward-topanel  issue 800672  has been merged into this one. Please manually review this issue to see if the duplicate is potentially eligible for a reward.

I'm afraid this was hit by internal fuzzers too.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot