It's worth briefly confirming how deep these are and that we're not stuck in a loop.

Yeah, let me take a look.

Let me mark this WONTFIX.
ccing: yosin@ because document.execCommnad might be called recursively here.

It would be hard to know what is going on the test case, which looks super-weird, however, it looks the test case caused the infinite loop by calling document.execCommand recursively and/or using setTimeout/setInterval.

That would make the deep tree like:

 │  │  │  ├─ Element::InsertedInto [Element.cpp:1615] this: 0x2bcc3bab130(LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en (A.d) [path: <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en> / <OPTION class=CLASS4 title=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA a label=A> / <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en>]) insertion_point: 0x2bcc3ba57f0(LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en (A.d) [path: <LINK class=CLASS12 CLASS10 dir=rtl xml:lang=en>])

Document#execCommand prevents recursive call of Document#execCommand.
It seems CF script creates deeply nested svg::use element?

Ah, thanks. I think you are correct.
I just saw the warning messages for "recursively document.execCommand" in dev console. Blink prevents it, I think.

ClusterFuzz has detected this issue as fixed in range 471041:471079.

Detailed report: https://clusterfuzz.com/testcase?key=6581771845238784

Fuzzer: bj_broddelwerk
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Stack-overflow
Crash Address: 0x7fff57c10fa0
Crash State:
  blink::Node::recalcDistribution
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=450347:450401
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=471041:471079

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6581771845238784


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.