Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/f911e11e7f6b5c0d6f5ee694a9871de6619889f7 (Reland "[CI] Make paint property nodes non-ref-counted").

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8040fa96ca6032e5a699e1ddf6bded788afa0a01

commit 8040fa96ca6032e5a699e1ddf6bded788afa0a01
Author: Xianzhu Wang <wangxianzhu@chromium.org>
Date: Sun Jun 03 20:17:54 2018

Partly revert "Reland "[CI] Make paint property nodes non-ref-counted""

This reverts commit f911e11e7f6b5c0d6f5ee694a9871de6619889f7.

Reason for revert: Clusterfuzz still reported problems.

This is not a full revert, but keep the non-ref-counted function
interfaces and shorter test code so that it will be easier to switch
to full non-ref-counted again.

Original change's description:
> Reland "[CI] Make paint property nodes non-ref-counted"
>
> This reverts commit 887383b30842d9d9006e11bb6932660a3cb5b1b7.
>
> Reason for revert: Retry in M69.
>
> Original change's description:
> > Revert "[CI] Make paint property nodes non-ref-counted"
> >
> > This reverts commit 70fc0b018c9517558b7aa2be00edf2debb449123.
> >
> > Reason for revert: Caused bugs found by clusterfuzz
> >
> > Original change's description:
> > > [CI] Make paint property nodes non-ref-counted
> > >
> > > Now all paint property nodes are owned by ObjectPaintProperties
> > > (and LocalFrameView temporarily before removing non-RLS mode).
> > > Others just use raw pointers or references.
> > >
> > > Bug: 833496
> > > Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
> > > Change-Id: I2d544fe153bb94698623248748df63c8aa2081ae
> > > Reviewed-on: https://chromium-review.googlesource.com/1031101
> > > Reviewed-by: Tien-Ren Chen <trchen@chromium.org>
> > > Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#554626}
> >
> > TBR=wangxianzhu@chromium.org,trchen@chromium.org,chrishtr@chromium.org
> >
> > Change-Id: I02bb50d6744cb81a797246a0116b677e80a3c69f
> > No-Presubmit: true
> > No-Tree-Checks: true
> > No-Try: true
> > Bug: 833496, 837932 , 837943 
> > Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
> > Reviewed-on: https://chromium-review.googlesource.com/1034292
> > Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
> > Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#554653}
>
> TBR=wangxianzhu@chromium.org,trchen@chromium.org,chrishtr@chromium.org
>
> # Not skipping CQ checks because original CL landed > 1 day ago.
>
> Bug: 833496,  837932 ,  837943 
> Change-Id: I0b4ef70db1f1f211ba97c30d617225355c750992
> Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
> Reviewed-on: https://chromium-review.googlesource.com/1083491
> Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
> Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#563930}

TBR=wangxianzhu@chromium.org,trchen@chromium.org,chrishtr@chromium.org

Change-Id: I1491f062f2e337cdf329c26742cef33437baca0c
Bug: 833496,  849033 ,  849036 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Reviewed-on: https://chromium-review.googlesource.com/1083700
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#563974}
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/core/paint/find_paint_offset_and_visual_rect_needing_update.h
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/core/paint/fragment_data.h
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/core/paint/object_paint_properties.h
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/BUILD.gn
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/compositing/chunk_to_layer_mapper.cc
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/compositing/chunk_to_layer_mapper_test.cc
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/compositing/composited_layer_raster_invalidator.cc
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/compositing/composited_layer_raster_invalidator.h
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/compositing/composited_layer_raster_invalidator_test.cc
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/compositing/paint_artifact_compositor.cc
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/compositing/paint_artifact_compositor_test.cc
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/clip_paint_property_node.cc
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/clip_paint_property_node.h
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/effect_paint_property_node.cc
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/effect_paint_property_node.h
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/paint_chunk.h
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/paint_controller.cc
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/paint_property_node.h
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/paint_property_node_test.cc
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/property_tree_state_test.cc
[add] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/ref_counted_property_tree_state.cc
[add] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/ref_counted_property_tree_state.h
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/scroll_paint_property_node.cc
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/scroll_paint_property_node.h
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/transform_paint_property_node.cc
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/graphics/paint/transform_paint_property_node.h
[modify] https://crrev.com/8040fa96ca6032e5a699e1ddf6bded788afa0a01/third_party/blink/renderer/platform/testing/paint_property_test_helpers.h

ClusterFuzz has detected this issue as fixed in range 563973:563974.

Detailed report: https://clusterfuzz.com/testcase?key=5296618132471808

Fuzzer: miaubiz_svg_fuzzer
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: Heap-use-after-free READ 4
Crash Address: 0xf3a3c6f0
Crash State:
  blink::GeometryMapper::SourceToDestinationProjectionInternal
  blink::GeometryMapper::SourceToDestinationProjection
  blink::ConversionContext::SwitchToClip
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_v8_arm&range=563929:563930
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_v8_arm&range=563973:563974

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5296618132471808

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5296618132471808 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

I'm afraid this was found internally as  issue 849109 

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot