This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

nikunjb: It looks like crrev.com/c/963843 has a change in visible_units_word.cc, which might be related, can you take a look? Thanks.

It looks like the culprit CL might be: https://chromium-review.googlesource.com/c/chromium/src/+/1004536

Assigning owner on the basis of that.

M67 Stable promotion is coming soon. Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and request a merge into the release branch ASAP. Thank you.

Change ReleaseBlock to M68 because the patch caused by this bug is reverted on M67 branch http://crrev.com/c/1013445

http://crrev.com/c/1018923 should fix this issue.

ClusterFuzz has detected this issue as fixed in range 557391:557426.

Detailed report: https://clusterfuzz.com/testcase?key=5214266685390848

Fuzzer: bj_broddelwerk
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x55f883735240
Crash State:
  Bad-cast to blink::LayoutBlock from blink::LayoutText
  blink::ToLayoutBlock
  blink::TextOffsetMapping::ComputeContainigBlock
  
Sanitizer: cfi (CFI)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=550071:550107
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=557391:557426

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5214266685390848

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5214266685390848 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug requires manual review: M68 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), kariahda@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

no merge needed

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot