Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/bd50b1c0b4eb22d57b67dd75b376fa1d20c0b795 (Remove GpuClientImpl dependency on GpuProcessHost).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/39670fd33c7874f73b14f5ce4f0b40414f07a46e

commit 39670fd33c7874f73b14f5ce4f0b40414f07a46e
Author: Mohsen Izadi <mohsen@chromium.org>
Date: Thu Aug 09 14:16:22 2018

Make callback in BrowserGpuClientDelegate non-member function

BrowserGpuClientDelegate might have been destroyed when
OnEstablishGpuChannel callback is run. Although this callback does not
use |this| and just runs the other callback passed to it, it is
technically an undefined behavior. Making it a non-member function,
helps us avoid this undefined behavior.

BUG= 872140 , 872219 , 872244 


Change-Id: I7cfff32c1ead8c5d6b5188086c9d8af402cf0da0
Reviewed-on: https://chromium-review.googlesource.com/1167649
Reviewed-by: Antoine Labour <piman@chromium.org>

[modify] https://crrev.com/39670fd33c7874f73b14f5ce4f0b40414f07a46e/content/browser/gpu/browser_gpu_client_delegate.cc
[modify] https://crrev.com/39670fd33c7874f73b14f5ce4f0b40414f07a46e/content/browser/gpu/browser_gpu_client_delegate.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c12ccc76fe130b90e58da3bc260c5f34a12ffe1c

commit c12ccc76fe130b90e58da3bc260c5f34a12ffe1c
Author: Andrii Shyshkalov <tandrii@chromium.org>
Date: Thu Aug 09 19:27:37 2018

Revert "Make callback in BrowserGpuClientDelegate non-member function"

This reverts commit 39670fd33c7874f73b14f5ce4f0b40414f07a46e.

Reason for revert: Due to Gerrit outage  http://crbug.com/872722 , we are reverting this CL. Please, re-land it after all clear is given. If you have questions, please ask on the bug. Sorry for the inconvenience.

Original change's description:
> Make callback in BrowserGpuClientDelegate non-member function
> 
> BrowserGpuClientDelegate might have been destroyed when
> OnEstablishGpuChannel callback is run. Although this callback does not
> use |this| and just runs the other callback passed to it, it is
> technically an undefined behavior. Making it a non-member function,
> helps us avoid this undefined behavior.
> 
> BUG= 872140 , 872219 , 872244 
> 
> 
> Change-Id: I7cfff32c1ead8c5d6b5188086c9d8af402cf0da0
> Reviewed-on: https://chromium-review.googlesource.com/1167649
> Reviewed-by: Antoine Labour <piman@chromium.org>

TBR=mohsen@chromium.org,piman@chromium.org

Change-Id: I951fc653bd9b06c1b507736b036b2b60a9aadf40
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  872140 ,  872219 ,  872244 
Reviewed-on: https://chromium-review.googlesource.com/1169796
Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>

[modify] https://crrev.com/c12ccc76fe130b90e58da3bc260c5f34a12ffe1c/content/browser/gpu/browser_gpu_client_delegate.cc
[modify] https://crrev.com/c12ccc76fe130b90e58da3bc260c5f34a12ffe1c/content/browser/gpu/browser_gpu_client_delegate.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1a49e225c111a22448c13c1527904ef7caa8da4d

commit 1a49e225c111a22448c13c1527904ef7caa8da4d
Author: Mohsen Izadi <mohsen@chromium.org>
Date: Fri Aug 10 03:07:26 2018

Make callback in BrowserGpuClientDelegate non-member function

BrowserGpuClientDelegate might have been destroyed when
OnEstablishGpuChannel callback is run. Although this callback does not
use |this| and just runs the other callback passed to it, it is
technically an undefined behavior. Making it a non-member function,
helps us avoid this undefined behavior.

BUG= 872140 , 872219 , 872244 

Change-Id: Id7641c6c3ff2dcb153e9ed9b245013e878cc947a
Reviewed-on: https://chromium-review.googlesource.com/1169964
Reviewed-by: Antoine Labour <piman@chromium.org>
Commit-Queue: Mohsen Izadi <mohsen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#582031}
[modify] https://crrev.com/1a49e225c111a22448c13c1527904ef7caa8da4d/content/browser/gpu/browser_gpu_client_delegate.cc
[modify] https://crrev.com/1a49e225c111a22448c13c1527904ef7caa8da4d/content/browser/gpu/browser_gpu_client_delegate.h

ClusterFuzz has detected this issue as fixed in range 582029:582034.

Detailed report: https://clusterfuzz.com/testcase?key=6366786317189120

Fuzzer: puzzor
Job Type: linux_ubsan_vptr_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x36f4c3b32b50
Crash State:
  Bad-cast to content::BrowserGpuClientDelegate from device::mojom::ScreenOrientationRequestValidator
  void base::internal::FunctorTraits<void
  MakeItSo<void
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=581450:581451
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=582029:582034

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6366786317189120

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6366786317189120 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

(also found by internal fuzzers)

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot