Findit Result:
===============
Suspected CLs	Unable to determine culprit CLs without crash revision and regression information

Suspected Project: chromium
Suspected Component: Blink>Layout

Based on the code search on 'LayoutObject.h', suspected change: https://codereview.chromium.org/2203933002

wangxianzhu@: Could you please take a look at this.

Thank you!

ClusterFuzz has detected this issue as fixed in range 38405:38413.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5532691393150976

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_asan_chrome_v8_ignition
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000018
Crash State:
  blink::LayoutTableSection::layoutRows
  blink::LayoutTable::layout
  blink::LayoutBlockFlow::positionAndLayoutOnceIfNeeded
  
Regressed: V8: r38259:38265
Fixed: V8: r38405:38413

Minimized Testcase (0.11 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv969jS0zjwwyxV1YzfTLG4Bm45FJIDzYxETV79SOa26_raWWvuYkmjDSH9GaeqYSDSSt1nqcJ4kch9KHMN6OCtFXSoh8Ig9Il5b9oeRT3NZax0rFLj3b5so6tKm2jO7hbS950aMMPDaKmBjHmOEHry2bHX_HXg?testcase_id=5532691393150976
<table cellspacing="1">
    <td>
     <style>
   body { -webkit-column-width: 50px; }
    tr { break-inside:avoid;


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot