Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

farahcharab: Would you mind taking a look at this or passing it along to the correct owner?

Sure, taking a look now.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0f2a4c74fd80904576b1d3738135699928b1059d

commit 0f2a4c74fd80904576b1d3738135699928b1059d
Author: Farah Charab <farahcharab@google.com>
Date: Fri Jul 27 16:06:04 2018

SQM Fuzzer: Invalid vptr in base::TestMockTimeTaskRunner.

Bad-cast to base::TestMockTimeTaskRunner from invalid vptr
in base::TestMockTimeTaskRunner::MockClock::NowTicks

test_task_runner_ was getting destructed before the sequence
manager (which calls the test_task_runner_ upon its
destruction).

Bug:  867790 
Change-Id: I412b6a720b4607deeaad1ce80d8bd601dfc04814
Reviewed-on: https://chromium-review.googlesource.com/1152979
Commit-Queue: Farah Charab <farahcharab@chromium.org>
Reviewed-by: Alexander Timin <altimin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#578662}
[modify] https://crrev.com/0f2a4c74fd80904576b1d3738135699928b1059d/third_party/blink/renderer/platform/scheduler/base/sequence_manager_fuzzer_processor.h

Thanks for the fix! Taking this out of the security queue since it's fuzzer-only.

ClusterFuzz has detected this issue as fixed in range 578660:578662.

Detailed report: https://clusterfuzz.com/testcase?key=6217665321107456

Fuzzer: libFuzzer_sequence_manager_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x36db87beddc0
Crash State:
  Bad-cast to base::TestMockTimeTaskRunner from invalid vptr
  base::TestMockTimeTaskRunner::MockClock::NowTicks
  base::sequence_manager::LazyNow::Now
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=576877:576893
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_ubsan&range=578660:578662

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6217665321107456

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6217665321107456 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

 Issue 868656  has been merged into this issue.