Thanks for the report. I'm assigning a medium vulnerability for now since it seems to be a race condition.

+danakj, based on https://chromium-review.googlesource.com/1033421, do you mind following up on this?

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This is a video-in-surfaces use of VideoResourceProvider, it looks like after it is destroyed.

   #0 0x55fe6619ca91 in __interceptor_backtrace /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:3980:13
    #1 0x55fe6e259ace in base::debug::StackTrace::StackTrace(unsigned long) /home/cowboy/chromium/src/out/chrome_asan_shared/../../base/debug/stack_trace_posix.cc:808:41
    #2 0x55fe6e2589e5 in base::debug::(anonymous namespace)::StackDumpSignalHandler(int, siginfo_t*, void*) /home/cowboy/chromium/src/out/chrome_asan_shared/../../base/debug/stack_trace_posix.cc:334:3
    #3 0x7faeece2c390 in __funlockfile ??:?
    #4 0x7faeece2c390 in ?? ??:0
    #5 0x55fe7c058413 in software_compositor /home/cowboy/chromium/src/out/chrome_asan_shared/../../cc/resources/video_resource_updater.h:133:45
    #6 0x55fe7c058413 in cc::VideoResourceUpdater::CreateForSoftwarePlanes(scoped_refptr<media::VideoFrame>) /home/cowboy/chromium/src/out/chrome_asan_shared/../../cc/resources/video_resource_updater.cc:773:0
    #7 0x55fe7c054d91 in cc::VideoResourceUpdater::CreateExternalResourcesFromVideoFrame(scoped_refptr<media::VideoFrame>) /home/cowboy/chromium/src/out/chrome_asan_shared/../../cc/resources/video_resource_updater.cc:549:12
    #8 0x55fe7c053edc in cc::VideoResourceUpdater::ObtainFrameResources(scoped_refptr<media::VideoFrame>) /home/cowboy/chromium/src/out/chrome_asan_shared/../../cc/resources/video_resource_updater.cc:372:7
    #9 0x55fe7c052c03 in blink::VideoFrameResourceProvider::AppendQuads(viz::RenderPass*, scoped_refptr<media::VideoFrame>, media::VideoRotation) /home/cowboy/chromium/src/out/chrome_asan_shared/../../third_party/blink/renderer/platform/graphics/video_frame_resource_provider.cc:86:22
    #10 0x55fe7c04cb69 in blink::VideoFrameSubmitter::SubmitFrame(viz::BeginFrameAck, scoped_refptr<media::VideoFrame>) /home/cowboy/chromium/src/out/chrome_asan_shared/../../third_party/blink/renderer/platform/graphics/video_frame_submitter.cc:202:23
    #11 0x55fe7c051708 in Invoke<void (blink::VideoFrameSubmitter::*)(viz::BeginFrameAck, scoped_refptr<media::VideoFrame>), base::WeakPtr<blink::VideoFrameSubmitter>, viz::BeginFrameAck, scoped_refptr<media::VideoFrame> > /home/cowboy/chromium/src/out/chrome_asan_shared/../../base/bind_internal.h:447:12
    #12 0x55fe7c051708 in MakeItSo<void (blink::VideoFrameSubmitter::*)(viz::BeginFrameAck, scoped_refptr<media::VideoFrame>), base::WeakPtr<blink::VideoFrameSubmitter>, viz::BeginFrameAck, scoped_refptr<media::VideoFrame> > /home/cowboy/chromium/src/out/chrome_asan_shared/../../base/bind_internal.h:567:0
    #13 0x55fe7c051708 in RunImpl<void (blink::VideoFrameSubmitter::*)(viz::BeginFrameAck, scoped_refptr<media::VideoFrame>), std::__1::tuple<base::WeakPtr<blink::VideoFrameSubmitter>, viz::BeginFrameAck, scoped_refptr<media::VideoFrame> >, 0, 1, 2> /home/cowboy/chromium/src/out/chrome_asan_shared/../../base/bind_internal.h:621:0
    #14 0x55fe7c051708 in base::internal::Invoker<base::internal::BindState<void (blink::VideoFrameSubmitter::*)(viz::BeginFrameAck, scoped_refptr<media::VideoFrame>), base::WeakPtr<blink::VideoFrameSubmitter>, viz::BeginFrameAck, scoped_refptr<media::VideoFrame> >, void ()>::RunOnce(base::internal::BindStateBase*) /home/cowboy/chromium/src/out/chrome_asan_shared/../../base/bind_internal.h:589:0
    #15 0x55fe6e022ec9 in Run /home/cowboy/chromium/src/out/chrome_asan_shared/../../base/callback.h:96:12
    #16 0x55fe6e022ec9 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) /home/cowboy/chromium/src/out/chrome_asan_shared/../../base/debug/task_annotator.cc:101:0
    #17 0x55fe6e08c071 in base::MessageLoop::RunTask(base::PendingTask*) /home/cowboy/chromium/src/out/chrome_asan_shared/../../base/message_loop/message_loop.cc:319:25

=> lethalantidote.  i suspect this is the same case that will be fixed by: https://chromium-review.googlesource.com/c/chromium/src/+/1069843

Yeah I agree.. I think it's the same bug. 

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot