Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/52d55d36c78e4772e0e3499409dc6f6dcabde00e (Make InsertText command not to split SPAN element containing TAB character).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

So it's like we can get null Node::ComputedStyle even with clean style?

This looks like P3. The HTML pattern required is very unusual.

Minimal repro:

<p>foo</p>
<label><option><input></option></label>
<script>
document.designMode = 'on';
document.execCommand("selectAll");
document.execCommand("InsertText", false, "\t");
</script>

DOM tree when the null-deref happens:

BODY (editable) (focused)
	LABEL (editable)
		OPTION (editable)
			#shadow-root(UserAgent)
*			SPAN style="white-space:pre" (editable)
				#text "\t"
			BR (editable)
			INPUT (editable)
				#shadow-root(UserAgent)
					DIV

 Issue 791609  has been merged into this issue.

ClusterFuzz testcase 6599738064633856 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

ClusterFuzz has detected this issue as fixed in range 531491:531492.

Detailed report: https://clusterfuzz.com/testcase?key=5974060818497536

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000040
Crash State:
  blink::IsTabHTMLSpanElement
  blink::EditingStyle::Init
  blink::EditingStyle::Create
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=506675:506834
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=531491:531492

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5974060818497536

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.