Findit information
===============
No CL in the regression range changes the crashed files. The result is the blame information.

Author: abarth@webkit.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/2b290dcc8a961ea01050ff55531250e4168ce58c
Time: Mon Sep 13 08:39:36 2010
The CL last changed line 1409 of file HTMLTreeBuilder.cpp, which is stack frame 0.

Author: abarth@webkit.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/027118e94c8d12c0cb42011a06a2aab98722480c
Time: Fri Jun 25 23:36:37 2010
The CL last changed line 421 of file HTMLTreeBuilder.cpp, which is stack frame 1.

Author: abarth@webkit.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/6c1e5835e2ca8a1db1f861830f30436a591f2545
Time: Thu Dec 15 21:35:23 2011
The CL last changed line 381 of file HTMLTreeBuilder.cpp, which is stack frame 2.

Author: eric@webkit.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/7f3d6e44a7987358a6400f2a7819a37cfa9b318d
Time: Fri Mar 08 19:15:40 2013
The CL last changed line 660 of file HTMLDocumentParser.cpp, which is stack frame 3.

Author: abarth@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/8a4546f8e79479c46435df054595323175209361
Time: Fri May 10 00:36:51 2013
The CL last changed line 459 of file HTMLDocumentParser.cpp, which is stack frame 4.

Author: yutak
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/995cd784dac8a41053410ca3fae7f7b57cd4ebad
Time: Mon May 16 07:50:26 2016
The CL last changed line 533 of file HTMLDocumentParser.cpp, which is stack frame 5.

Author: kouhei@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/00c8220e161b09e7131bc1cb1e4e9d9eb1f97303
Time: Sat Oct 11 07:38:44 2014
The CL last changed line 249 of file HTMLDocumentParser.cpp, which is stack frame 6.

Suspected Project: chromium
Suspected Component: Blink>HTML
==============

Regressed CL::
==================
https://chromium.googlesource.com/chromium/src/+log/4e2a19affa8bedecca8965804e9e9d137709d04d..eed4b232667ff6b276777500ffd64d86232cf25c?pretty=fuller

Possible suspect
==================
https://codereview.chromium.org/2101523002

dominicc@ could you please look into this issue if it is related to your change,else please help us in finding the appropriate owner for this issue.

Thanks,

Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz has detected this issue as fixed in range 404631:404810.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5423874774925312

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: ASSERT_NOT_REACHED
Crash Address: 
Crash State:
  blink::HTMLTreeBuilder::processStartTag
  blink::HTMLTreeBuilder::processToken
  blink::HTMLTreeBuilder::constructTree
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=403457:403667
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=404631:404810

Minimized Testcase (0.03 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94xMVrhftfVcA-MeFosnnuX3YEIflJ_ztHNq0OQyvhkWvwbjX5sd6mQeyOsLDwu-sTM6VT8yShLoTpJqC2V03VDDb3cLDeo7S80OL8aBsjYq0700UNjTSkCzlf1-IuuazDGCkmr2Hd5L9ifJ4TggaysW-acjA?testcase_id=5423874774925312
<svg>
<desc></svg>
<xmp>
<title>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 404631:404810.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5423874774925312

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: ASSERT_NOT_REACHED
Crash Address: 
Crash State:
  blink::HTMLTreeBuilder::processStartTag
  blink::HTMLTreeBuilder::processToken
  blink::HTMLTreeBuilder::constructTree
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=403457:403667
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=404631:404810

Minimized Testcase (0.03 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94xMVrhftfVcA-MeFosnnuX3YEIflJ_ztHNq0OQyvhkWvwbjX5sd6mQeyOsLDwu-sTM6VT8yShLoTpJqC2V03VDDb3cLDeo7S80OL8aBsjYq0700UNjTSkCzlf1-IuuazDGCkmr2Hd5L9ifJ4TggaysW-acjA?testcase_id=5423874774925312
<svg>
<desc></svg>
<xmp>
<title>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot