Regression CL::
https://chromium.googlesource.com/chromium/src/+log/8fcd3f03a3a531f12bb291dc8665834d85511c23..a0ccb0df60af245b02a405fef95822b658f10381?pretty=fuller

Possible suspect from the above CL
 https://codereview.chromium.org/2133603002

wangxianzhu@ Could you please look into this issue if it is related to your change,else please route this to an appropriate owner for this issue.

Thanks,

Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f19f54dd68934165d539d3d1aaeb90a24f7e0049

commit f19f54dd68934165d539d3d1aaeb90a24f7e0049
Author: wangxianzhu <wangxianzhu@chromium.org>
Date: Wed Jul 20 01:06:41 2016

Ensure invalidation in LayoutBlockChildNode::removeChildNodes() without notifyLayoutObject

Some callers of LayoutBlockChildNode::removeChildNodes() passes
notifyLayoutObject=false and we missed invalidation of the painting
layer and the object.

The test case is converted from a cluster-fuzz test case.

BUG= 628146 

Review-Url: https://codereview.chromium.org/2160723006
Cr-Commit-Position: refs/heads/master@{#406436}

[modify] https://crrev.com/f19f54dd68934165d539d3d1aaeb90a24f7e0049/third_party/WebKit/LayoutTests/TestExpectations
[add] https://crrev.com/f19f54dd68934165d539d3d1aaeb90a24f7e0049/third_party/WebKit/LayoutTests/paint/invalidation/remove-anonymous-block-crash-expected.txt
[add] https://crrev.com/f19f54dd68934165d539d3d1aaeb90a24f7e0049/third_party/WebKit/LayoutTests/paint/invalidation/remove-anonymous-block-crash.html
[modify] https://crrev.com/f19f54dd68934165d539d3d1aaeb90a24f7e0049/third_party/WebKit/Source/core/layout/LayoutObjectChildList.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a88ce75084a15a4b1641d5fd6043dcfdeb33ff57

commit a88ce75084a15a4b1641d5fd6043dcfdeb33ff57
Author: Rebaseline Bot <blink-rebaseline-bot@chromium.org>
Date: Wed Jul 20 02:42:08 2016

Auto-rebaseline for r406436

https://chromium.googlesource.com/chromium/src/+/f19f54dd6

BUG= 628146 
TBR=wangxianzhu@chromium.org

Review URL: https://codereview.chromium.org/2167583002 .

Cr-Commit-Position: refs/heads/master@{#406471}

[modify] https://crrev.com/a88ce75084a15a4b1641d5fd6043dcfdeb33ff57/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/a88ce75084a15a4b1641d5fd6043dcfdeb33ff57/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/make-children-non-inline-expected.txt
[modify] https://crrev.com/a88ce75084a15a4b1641d5fd6043dcfdeb33ff57/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/make-children-non-inline-expected.txt
[modify] https://crrev.com/a88ce75084a15a4b1641d5fd6043dcfdeb33ff57/third_party/WebKit/LayoutTests/platform/win/fast/repaint/make-children-non-inline-expected.txt

ClusterFuzz has detected this issue as fixed in range 406435:406472.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6188529881448448

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !item.value.contains(this). Short-lived DisplayItemClient: "LayoutBlockFlow (ano
  blink::DisplayItemClient::~DisplayItemClient
  blink::LayoutObject::~LayoutObject
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=404506:404552
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=406435:406472

Minimized Testcase (0.45 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96XF9dHzPiQKJYeQxdtQ0UVxqAJCabTwM8A5TMr5mkFxALYTDaR3-2Z1lAU7IsLQl08Hg-6HiQDVC7GGBKYg0Bk_qG0E3bY-Wcb8A9aqnvPTDes43lz2Oyc8xb6Uz0vveR0PzPVwWjRSJfCsCB6t6RfzSSOMA?testcase_id=6188529881448448
  <script type="text/JavaScript">
function __f_10() {
    document.execCommand("JustifyRight");
}
</script>
  <div contenteditable=""<div style="position: absolute; background-color: red">
    id="item4">
<ul>
    <li>
     <span id="item5">
      This should not be in a list.
    </li>
  <script>
var s = window.getSelection();
s.collapse(document.getElementById("item5"));
document.execCommand("InsertUnorderedList");
  </script>
<script>
 __f_10(); 
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Your change meets the bar and is auto-approved for M53 (branch: 2785)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f3d584d7a3188951128b5daa2b1d9f15e5306b52

commit f3d584d7a3188951128b5daa2b1d9f15e5306b52
Author: Xianzhu Wang <wangxianzhu@chromium.org>
Date: Thu Jul 21 05:58:32 2016

Ensure invalidation in LayoutBlockChildNode::removeChildNodes() without notifyLayoutObject

Some callers of LayoutBlockChildNode::removeChildNodes() passes
notifyLayoutObject=false and we missed invalidation of the painting
layer and the object.

The test case is converted from a cluster-fuzz test case.

BUG= 628146 

Review URL: https://codereview.chromium.org/2163873003 .

Review-Url: https://codereview.chromium.org/2160723006
Cr-Original-Commit-Position: refs/heads/master@{#406436}
Cr-Commit-Position: refs/branch-heads/2785@{#259}
Cr-Branched-From: 68623971be0cfc492a2cb0427d7f478e7b214c24-refs/heads/master@{#403382}

[modify] https://crrev.com/f3d584d7a3188951128b5daa2b1d9f15e5306b52/third_party/WebKit/LayoutTests/TestExpectations
[add] https://crrev.com/f3d584d7a3188951128b5daa2b1d9f15e5306b52/third_party/WebKit/LayoutTests/paint/invalidation/remove-anonymous-block-crash-expected.txt
[add] https://crrev.com/f3d584d7a3188951128b5daa2b1d9f15e5306b52/third_party/WebKit/LayoutTests/paint/invalidation/remove-anonymous-block-crash.html
[modify] https://crrev.com/f3d584d7a3188951128b5daa2b1d9f15e5306b52/third_party/WebKit/Source/core/layout/LayoutObjectChildList.cpp

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot