This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/304237d65a5dbeaca92a2a9a276b4cb903b5ad14 (Implement nested dedicated workers).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/67d115aea36795a27e55d974d618afbb58662e7a

commit 67d115aea36795a27e55d974d618afbb58662e7a
Author: Nate Chapin <japhet@chromium.org>
Date: Thu Jul 26 23:36:13 2018

Fix shutdown-time race between creating and destroying nested workers

Bug:  865950 
Change-Id: I8c35b78802b5ccafbfd0433c9e6bee4b04bb4136
Reviewed-on: https://chromium-review.googlesource.com/1145872
Commit-Queue: Nate Chapin <japhet@chromium.org>
Reviewed-by: Hiroki Nakagawa <nhiroki@chromium.org>
Cr-Commit-Position: refs/heads/master@{#578484}
[modify] https://crrev.com/67d115aea36795a27e55d974d618afbb58662e7a/third_party/blink/renderer/core/workers/worker_thread.cc
[modify] https://crrev.com/67d115aea36795a27e55d974d618afbb58662e7a/third_party/blink/renderer/core/workers/worker_thread.h
[modify] https://crrev.com/67d115aea36795a27e55d974d618afbb58662e7a/third_party/blink/renderer/core/workers/worker_thread_test.cc

ClusterFuzz has detected this issue as fixed in range 578483:578484.

Detailed report: https://clusterfuzz.com/testcase?key=6092327505100800

Fuzzer: inferno_twister
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: Heap-use-after-free READ 8
Crash Address: 0x125418864200
Crash State:
  blink::WorkerThread::PrepareForShutdownOnWorkerThread
  blink::RunCrossThreadClosure
  base::internal::Invoker<struct base::internal::BindState<void
  
Sanitizer: address (ASAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=576224:576225
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=578483:578484

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6092327505100800

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6092327505100800 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Requesting merge. I don't know how long you want to let this bake before merging, but it should be pretty safe if clusterfuzz is happy with it.

+awhalley@ (Security TPM) for M69 merge review.

govind@ - good for 69, though probably best to wait until Monday to give a bit more time in Canary

Your change meets the bar and is auto-approved for M69. Please go ahead and merge the CL to branch 3497 manually. Please contact milestone owner if you have questions.
Owners: amineer@(Android), kariahda@(iOS), cindyb@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Please merge your change to M69 branch 3497 by 2:00 PM PT Monday, 07/30, so we can pick it up for next week last M69 Dev release. Thank you.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/eb814c12d43548f4b6614cb09655ea6e8a45d661

commit eb814c12d43548f4b6614cb09655ea6e8a45d661
Author: Nate Chapin <japhet@chromium.org>
Date: Mon Jul 30 19:11:54 2018

Fix shutdown-time race between creating and destroying nested workers

Bug:  865950 
Change-Id: I8c35b78802b5ccafbfd0433c9e6bee4b04bb4136
Reviewed-on: https://chromium-review.googlesource.com/1145872
Commit-Queue: Nate Chapin <japhet@chromium.org>
Reviewed-by: Hiroki Nakagawa <nhiroki@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#578484}(cherry picked from commit 67d115aea36795a27e55d974d618afbb58662e7a)
Reviewed-on: https://chromium-review.googlesource.com/1155487
Reviewed-by: Nate Chapin <japhet@chromium.org>
Cr-Commit-Position: refs/branch-heads/3497@{#227}
Cr-Branched-From: 271eaf50594eb818c9295dc78d364aea18c82ea8-refs/heads/master@{#576753}
[modify] https://crrev.com/eb814c12d43548f4b6614cb09655ea6e8a45d661/third_party/blink/renderer/core/workers/worker_thread.cc
[modify] https://crrev.com/eb814c12d43548f4b6614cb09655ea6e8a45d661/third_party/blink/renderer/core/workers/worker_thread.h
[modify] https://crrev.com/eb814c12d43548f4b6614cb09655ea6e8a45d661/third_party/blink/renderer/core/workers/worker_thread_test.cc

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot