This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Hi shenghao@, This might be related to your cl: 
https://chromium-review.googlesource.com/c/chromium/src/+/1167147

I think this is not related to https://chromium-review.googlesource.com/c/chromium/src/+/1167147, because the CL was submitted on 8/10 while the test report (https://clusterfuzz.com/v2/testcase-detail/6248992309248000?noredirect=1) was generated on 8/7.

It's likely that the already-reverted CL (https://chromium-review.googlesource.com/c/chromium/src/+/1152147) caused the regression, and the reland CL is innocent.

Hi shenghao@, if you look at the test failure, it points to: for (const auto& app : GetInternalAppList(false)), which is your change.

If you think you have fixed it. I will close this bug. If there still has problem, it will reopen.

I see. Yeah I think it's fixed in my reland CL. Let's close it.

ClusterFuzz has detected this issue as fixed in range 581307:581321.

Detailed report: https://clusterfuzz.com/testcase?key=6248992309248000

Fuzzer: inferno_flicker
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: Stack-use-after-return READ 8
Crash Address: 0x7f40a2a76120
Crash State:
  InternalAppWindowShelfController::OnWindowPropertyChanged
  aura::Window::AfterPropertyChange
  ui::PropertyHandler::SetPropertyInternal
  
Sanitizer: address (ASAN)

Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=581307:581321

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6248992309248000

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot