Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/6ed86dc39330bc5090f770575354cac16a3fe36c (Make speech recognition be per frame instead of per page.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a80562ec61f78615e1fc48dc2024623507977ba5

commit a80562ec61f78615e1fc48dc2024623507977ba5
Author: Avi Drissman <avi@chromium.org>
Date: Mon Mar 05 20:59:32 2018

Don't trust frame ids from the renderer.

BUG= 818509 
TEST=clusterfuzz verify

Change-Id: Ifbf90e9b0e67bbec6d41a95d25cfb83859936dec
Reviewed-on: https://chromium-review.googlesource.com/947770
Commit-Queue: Avi Drissman <avi@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Cr-Commit-Position: refs/heads/master@{#540929}
[modify] https://crrev.com/a80562ec61f78615e1fc48dc2024623507977ba5/content/browser/speech/speech_recognition_dispatcher_host.cc

That should fix it.

ClusterFuzz has detected this issue as fixed in range 540928:540931.

Detailed report: https://clusterfuzz.com/testcase?key=5091703376314368

Fuzzer: ipc_fuzzer_mut
Job Type: linux_asan_chrome_ipc
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x0000000004a8
Crash State:
  content::GuestMode::IsCrossProcessFrameGuest
  content::WebContentsImpl::GetOuterWebContents
  content::SpeechRecognitionDispatcherHost::OnStartRequest
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_ipc&range=540697:540699
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_ipc&range=540928:540931

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5091703376314368

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5091703376314368 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.