Through code search file 'HeapPage.h' suspecting the below
https://chromium.googlesource.com/chromium/src/+/6912b75d975aab08daffe5eb0ca89725f74294ac%5E%21/third_party/WebKit/Source/platform/heap/HeapPage.h

keishi@ Could you please look into this issue if its related to your change,else please re assign it to an appropriate dev person.

Is it exhausting the stack because of infinite regress during cloning and DOM mutations?

This is a 'Stack-overflow' issue, hence marking it as 'WontFix'.

ClusterFuzz has detected this issue as fixed in range 387299:387336.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5923766680420352

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7ffe8019ef58
Crash State:
  blink::SVGElement::addToPropertyMap
  blink::SVGElement::SVGElement
  blink::SVGScriptElement::cloneElementWithoutAttributesAndChildren
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=172836:173286
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=387299:387336

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95yiK1Qwe-2WNjYDYCqNjgLnyuuMO-ajYJd9L3siRzksMoIGp8NT9EKubJBJ9m63H6doGKuGBLfC_dlcY9t68NLO9IYXScX05niNd6AXEqErKv2ujSbhNI8bTPijvZbS0ZfKIgV9hB16lFTDnZNYCBBakbrrQ


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot