This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

lpy -- This looks like it was due to your CL https://chromium.googlesource.com/chromium/src/+/f3b25db89a2dfaad59a90573fe355bc60db0a899%5E%21/#F0
Can you take a look? Thanks.

IMO the patch is plain wrong. I suggest reverting it along with its V8 counterpart.

I agree to revert it, but like I explained in the design doc, we expose it because embedder have more knowledge of when an observer can be added to observer list.

Maybe we can discuss it offline.

ClusterFuzz has detected this issue as fixed in range 430257:430307.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5570136678596608

Fuzzer: inferno_twister
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x7f0df4556170
Crash State:
  Bad-cast to v8::Platform::TraceStateObserver from v8::tracing::TracingCategoryObserverImpl
  blink::Node::mutationObserverRegistry
  blink::Node::unregisterMutationObserver
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=428749:428854
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=430257:430307

Minimized Testcase (0.48 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96Bi5BSBZzLFMtt7wkNTFB3WPkvRn-G0mCyBFoRVpaLMXCkRP5ZbbhRSt9ZmbGZH5bpyU_oz1P9ZVpnV9GkS29SghPxxyIacoXVMRwp5WIqI_YIuLYD76wU8O6NqGKyLlJjp7IjYSedvbMvZFiFodIACt3Z8A?testcase_id=5570136678596608

Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot