[1:1:1109/002631:1617004753732:FATAL:Document.cpp(1818)] Check failed: !node.childNeedsStyleRecalc().
#0 0x0000004d4931 __interceptor_backtrace
#1 0x7f87b4f075ec base::debug::StackTrace::StackTrace()
#2 0x7f87b50952ff logging::LogMessage::~LogMessage()
#3 0x7f8791199295 blink::assertLayoutTreeUpdated()
#4 0x7f879118c379 blink::Document::updateStyleAndLayoutTree()
#5 0x7f87911c9cc2 blink::Document::finishedParsing()
#6 0x7f879295a039 blink::HTMLConstructionSite::finishedParsing()
#7 0x7f8792abc9f6 blink::HTMLTreeBuilder::finished()
#8 0x7f879298e85d blink::HTMLDocumentParser::end()
#9 0x7f87929779b4 blink::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd()
#10 0x7f87929774ea blink::HTMLDocumentParser::prepareToStopParsing()
#11 0x7f87929863ec blink::HTMLDocumentParser::processTokenizedChunkFromBackgroundParser()
#12 0x7f879297b15a blink::HTMLDocumentParser::pumpPendingSpeculations()
#13 0x7f879297a24a blink::HTMLDocumentParser::resumeParsingAfterYield()
#14 0x7f8792a03899 blink::HTMLParserScheduler::continueParsing()

I locally reproduced on Linux ToT (r430910), flaky (~25%).

The ChildNeedsStyleRecalcFlag flag of the first <use> node in the minimized test case is set but not cleared before the assertion.

When Chrome doesn't crash, the flag is cleared in:
#2 0x000009563fb8 blink::Node::clearChildNeedsStyleRecalc()
#3 0x0000095637d1 blink::ContainerNode::attachLayoutTree()
#4 0x0000096a64fd blink::Element::attachLayoutTree()
#5 0x00000afb0e82 blink::SVGElement::attachLayoutTree()
#6 0x000009563771 blink::ContainerNode::attachLayoutTree()
#7 0x0000096a64fd blink::Element::attachLayoutTree()
#8 0x00000afb0e82 blink::SVGElement::attachLayoutTree()
#9 0x000009563771 blink::ContainerNode::attachLayoutTree()
#10 0x0000096a64fd blink::Element::attachLayoutTree()
#11 0x000009563771 blink::ContainerNode::attachLayoutTree()
#12 0x0000096a64fd blink::Element::attachLayoutTree()
#13 0x00000977caf1 blink::Node::reattachLayoutTree()
#14 0x0000096ac42c blink::Element::rebuildLayoutTree()
#15 0x0000096aac6f blink::Element::recalcOwnStyle()
#16 0x0000096a9d6b blink::Element::recalcStyle()
#17 0x0000095f0043 blink::Document::updateStyle()
#18 0x0000095e3eff blink::Document::updateStyleAndLayoutTree()
#19 0x0000096230fb blink::Document::finishedParsing()
#20 0x00000a20e093 blink::HTMLDocumentParser::end()
#21 0x00000a1fa543 blink::HTMLDocumentParser::prepareToStopParsing()
#22 0x00000a204698 blink::HTMLDocumentParser::processTokenizedChunkFromBackgroundParser()
#23 0x00000a1fca4e blink::HTMLDocumentParser::pumpPendingSpeculations()

Looks like a layout issue. Removing Loader component flag.

@nainar, mind taking a look at this one?

Seems possibly related to the changes in  issue 595137 .

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sorry it took so long to get back on this. I have been investigating this bug and it seems like we are clearing the childNeedsStyleRecalc bit on use element but setting it again on a later stage. This issue is fixed by a WIP patch (for  bug 595137 ) here: https://codereview.chromium.org/2473743003. 

Will mark the patch as fixing this bug as well.

ClusterFuzz testcase 5108581471092736 is flaky and no longer reproduces, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.