Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

This issue looks similar to  bug 816448 , hence assigning to the same owner for more updates on this issue.

chrishtr@ could you please take a look in to this issue?

Thanks!

I think this is an error in loading SVG resources.t I think that sometimes when
the resource cache updates, it fails to SetNeedsPaintPropertyUpdate() for the SVG
layout object in question (which it should). ->fs who is working in this area
right now.

This looks like issue 814815 (or  issue 813446  for a concrete example.) Hence I don't think the theory in c#3 is correct. I suspect the best we can do short term is to apply duct tape (like in  issue 813446 .)

Minimized TC.

Deleted: issue825538.html 279 bytes

issue825538.html 279 bytes View Download

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/70ed485eaa84d518a7ca6854e3573eb6142ac91d

commit 70ed485eaa84d518a7ca6854e3573eb6142ac91d
Author: Fredrik Söderquist <fs@opera.com>
Date: Tue Apr 03 20:06:31 2018

[SPv175] Don't crash on <feImage> which reference an element with a mask

This works around a crash where a layout box references a filter that
contains a feImage filter primitive, which in turn reference content
that has a mask applied.

Bug: 814815,  825538 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: Ib2433b3ba48b3ea56462a1eb64209d36aa37cfa4
Reviewed-on: https://chromium-review.googlesource.com/982114
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Commit-Queue: Fredrik Söderquist <fs@opera.com>
Cr-Commit-Position: refs/heads/master@{#547802}
[add] https://crrev.com/70ed485eaa84d518a7ca6854e3573eb6142ac91d/third_party/WebKit/LayoutTests/svg/masking/mask-within-feimage-filter-on-root-crash.html
[modify] https://crrev.com/70ed485eaa84d518a7ca6854e3573eb6142ac91d/third_party/WebKit/Source/core/paint/SVGMaskPainter.cpp

ClusterFuzz has detected this issue as fixed in range 547800:547802.

Detailed report: https://clusterfuzz.com/testcase?key=5027143936114688

Fuzzer: miaubiz_svg_fuzzer
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000020
Crash State:
  blink::SVGMaskPainter::FinishEffect
  blink::SVGPaintContext::~SVGPaintContext
  blink::SVGShapePainter::Paint
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=543289:543291
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=547800:547802

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5027143936114688

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5027143936114688 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.