Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/df92bfed734a92c8f839af121218917ae599157d (cc::Surfaces for Video path handles null context_provider).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

 Issue 842683  has been merged into this issue.

 Issue 842433  has been merged into this issue.

This crash occurs very frequently on linux and mac platforms and is likely preventing the fuzzer ifratric-browserfuzzer-v3 from making much progress. Fixing this will allow more bugs to be found.

Marking this bug as a blocker for next Beta release.

If this is incorrect, please add ClusterFuzz-Wrong label and remove the ReleaseBlock-Beta label.

Issue 843475 has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/939341785c4fc716537629347a8357cfdcc8dd1d

commit 939341785c4fc716537629347a8357cfdcc8dd1d
Author: CJ DiMeglio <lethalantidote@chromium.org>
Date: Thu May 17 01:05:54 2018

Check |frame_sink_destroyed_callback_| before running.

Currently, there is a edge case where we may lose the context_provider
before we have set the callback to reset the frame sink. This change
guards against that, but in the future, we want to move
|frame_sink_destroyed_callback_|'s initialization to VideoFrameSubmitter's
construction time.

Bug:  842432 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I1437d2b91f416ff5f2f310530d6443f8f8014213
Reviewed-on: https://chromium-review.googlesource.com/1058341
Reviewed-by: Justin Novosad <junov@chromium.org>
Commit-Queue: CJ DiMeglio <lethalantidote@chromium.org>
Cr-Commit-Position: refs/heads/master@{#559378}
[modify] https://crrev.com/939341785c4fc716537629347a8357cfdcc8dd1d/third_party/blink/renderer/platform/graphics/video_frame_submitter.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/61cf3676d5595c9cb9ddeb6ded75154fffb0a4b4

commit 61cf3676d5595c9cb9ddeb6ded75154fffb0a4b4
Author: CJ DiMeglio <lethalantidote@chromium.org>
Date: Thu May 17 01:09:49 2018

Check |frame_sink_destroyed_callback_| before running.

Currently, there is a edge case where we may lose the context_provider
before we have set the callback to reset the frame sink. This change
guards against that, but in the future, we want to move
|frame_sink_destroyed_callback_|'s initialization to VideoFrameSubmitter's
construction time.

Bug:  842432 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I1437d2b91f416ff5f2f310530d6443f8f8014213
Reviewed-on: https://chromium-review.googlesource.com/1058341
Reviewed-by: Justin Novosad <junov@chromium.org>
Commit-Queue: CJ DiMeglio <lethalantidote@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#559378}(cherry picked from commit 939341785c4fc716537629347a8357cfdcc8dd1d)
Reviewed-on: https://chromium-review.googlesource.com/1063066
Reviewed-by: CJ DiMeglio <lethalantidote@chromium.org>
Cr-Commit-Position: refs/branch-heads/3432@{#5}
Cr-Branched-From: e4b3b7b5a403e7f006958187cd67a0d7d6d9306c-refs/heads/master@{#558914}
[modify] https://crrev.com/61cf3676d5595c9cb9ddeb6ded75154fffb0a4b4/third_party/blink/renderer/platform/graphics/video_frame_submitter.cc

ClusterFuzz testcase 5724767269945344 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

ClusterFuzz has detected this issue as fixed in range 559371:559378.

Detailed report: https://clusterfuzz.com/testcase?key=4943394472984576

Fuzzer: inferno_flicker
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x00000004
Crash State:
  blink::VideoFrameSubmitter::OnContextLost
  blink::VideoFrameSubmitter::OnContextLost
  ui::ContextProviderCommandBuffer::OnLostContext
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_v8_arm&range=557995:558002
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_v8_arm&range=559371:559378

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4943394472984576

Additional requirements: Requires Gestures

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Looks like the fix from C#9 missed today's canary version: 68.0.3433.0 that's why Issue 843475 crashes are still seen. However no crashes are seen on 68.0.3432.3 because of fix merged to 3432 branch in C#9.