The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/04c90b668f8bbc4e408cf88684f18359c7761120

commit 04c90b668f8bbc4e408cf88684f18359c7761120
Author: Sadrul Habib Chowdhury <sadrul@chromium.org>
Date: Tue Mar 06 18:58:23 2018

viz: Remove a workaround for SkMatrix44.

HitTestAggregator creates a shared memory segment, and populates it with
a list of AggregatedHitTestRegion objects. It then shares the memory with
HitTestQuery, which sees this as read-only data. However, when using the
gfx::Transform, which is backed by SkMatrix44, it can attempt to write to
the read-only shared memory (because SkMatrix44 has a mutable attribute
which can be changed during a const-method call), which causes failure
(crash) in HitTestQuery. To avoid this failure, always make a copy of the
gfx::Transform before using it in HitTestQuery.

BUG=819291

Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel
Change-Id: I97d23c25de7271e1813b1c4e0a4de05ce2cdc7c4
Reviewed-on: https://chromium-review.googlesource.com/950471
Commit-Queue: Sadrul Chowdhury <sadrul@chromium.org>
Reviewed-by: Ria Jiang <riajiang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#541162}
[modify] https://crrev.com/04c90b668f8bbc4e408cf88684f18359c7761120/components/viz/common/hit_test/aggregated_hit_test_region.h
[modify] https://crrev.com/04c90b668f8bbc4e408cf88684f18359c7761120/components/viz/host/hit_test/hit_test_query.cc
[modify] https://crrev.com/04c90b668f8bbc4e408cf88684f18359c7761120/components/viz/host/hit_test/hit_test_query_unittest.cc
[modify] https://crrev.com/04c90b668f8bbc4e408cf88684f18359c7761120/components/viz/service/hit_test/hit_test_aggregator.cc
[modify] https://crrev.com/04c90b668f8bbc4e408cf88684f18359c7761120/components/viz/service/hit_test/hit_test_aggregator_unittest.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ad8ab8fd70189c757e710a5b7335c8bf8be7188b

commit ad8ab8fd70189c757e710a5b7335c8bf8be7188b
Author: Sadrul Habib Chowdhury <sadrul@chromium.org>
Date: Fri Mar 09 00:53:07 2018

viz hit test: Add a fuzzer for hit-test-query.

Treat the fuzzer-input as the aggregated hit-test data, and run a bunch of
queries on that.

BUG=819291

Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel
Change-Id: Iab5b09820c2751126fd6a9f630848834b47d2dd0
Reviewed-on: https://chromium-review.googlesource.com/949407
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Reviewed-by: Ken Rockot <rockot@chromium.org>
Reviewed-by: Ria Jiang <riajiang@chromium.org>
Commit-Queue: Sadrul Chowdhury <sadrul@chromium.org>
Cr-Commit-Position: refs/heads/master@{#541970}
[modify] https://crrev.com/ad8ab8fd70189c757e710a5b7335c8bf8be7188b/components/viz/host/BUILD.gn
[modify] https://crrev.com/ad8ab8fd70189c757e710a5b7335c8bf8be7188b/components/viz/host/hit_test/DEPS
[add] https://crrev.com/ad8ab8fd70189c757e710a5b7335c8bf8be7188b/components/viz/host/hit_test/hit_test_query_fuzzer.cc