Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/145660d6a05041e0da6a412598a29741b9efe816 (Invalid viewport meta width/height value should fall back to auto.).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

I can still reproduce the crash with my patch's revert patch. https://chromium-review.googlesource.com/c/chromium/src/+/753802

yosin@, could you take a look?

Lower to Pri-3 since it is caused by unusual HTML and DOM mutation events.

ClusterFuzz has detected this issue as fixed in range 530461:530464.

Detailed report: https://clusterfuzz.com/testcase?key=5754367109234688

Fuzzer: inferno_twister
Job Type: linux_ubsan_vptr_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::Element::SetIntegralAttribute
  blink::Document::WillChangeFrameOwnerProperties
  blink::HTMLFrameElementBase::SetMarginWidth
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=508795:508862
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=530461:530464

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5754367109234688

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5754367109234688 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

@fergal FYI
Probably your CL fixed this as well.

https://chromium.googlesource.com/chromium/src/+/7d8f1e30e8d6918f4da3657e03be88d555deccd8

Yes, looks like. Thanks.