Issue 700716  has been merged into this issue.

 Issue 700720  has been merged into this issue.

 Issue 700729  has been merged into this issue.

 Issue 700749  has been merged into this issue.

 Issue 700754  has been merged into this issue.

 Issue 700768  has been merged into this issue.

 Issue 700775  has been merged into this issue.

 Issue 700793  has been merged into this issue.

 Issue 700718  has been merged into this issue.

Predator and CL did not provide any possible CL.
Using Code Search for the file, "ScriptForbiddenScope.h" assigning to the concern owner.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/3b4b07ced6315a25960ca5a51dd1b7ba88de53db

@esprehn -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

How do I annotate this as a benign race? It's safe and done for a performance optimization.

Possible fix: https://codereview.chromium.org/2753203002

Waiting on someone to reply to #12 to tell me what the correct thing to do is.

I've replied to the CL, but want to reiterate here: there's no such thing as a benign race, and one should not introduce data races to optimize for performance.

Hope swapping isMainThread() and s_scriptForbiddenCount shall help.

I disagree about the race here, but I'm too tired to argue about it. I reverted it.

ClusterFuzz has detected this issue as fixed in range 458081:458090.

Detailed report: https://clusterfuzz.com/testcase?key=5762329708068864

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 4
Crash Address: 0x7f1e14b96178
Crash State:
  blink::Document::updateStyleAndLayoutTree
  blink::Document::updateStyleAndLayoutTreeIgnorePendingStylesheets
  blink::Document::updateStyleAndLayoutIgnorePendingStylesheets
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=456256:456287
Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=458081:458090

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv975047IW33NglNqprUDz5GNOSHSD-mqWov1cdQsmciAAHqmJcD3VsSewmco5rN3TdW7mB8vRZ6SPBFIfi5jWwLvV-8xT2NZt0MHDDkmgTW-oSaueEXmen67xF8KVoRzQaPCyTIgDQ9-W0SyCiYHzKkCWGd7lIdXKSHOgysq_aRz2eVLM8VuEFjXScmD06lTdWAMUgBG4Y4g8ZIZbVKlqqpHwlVkWpAcP1cGQlYpiZbaIdodXbvddwgzKJSbFSGASy6Mpv9mZBRP0dxP2AXmNxrRLQARaaJMMa6btjnHBdBHju8Qkj_k1AhVZ3gEtJw2zkxTrH2N2FMBFSnLSqUvS-W2v5buNMSI3OTKI0dA7SiZWYQD-sc?testcase_id=5762329708068864


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.