Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/534ecb7b67e43f206cf8ad645ff8d69286261db0 ([css-grid] Treat 'auto' as 0px when compute non-laid out item's margins).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/534ecb7b67e43f206cf8ad645ff8d69286261db0 ([css-grid] Treat 'auto' as 0px when compute non-laid out item's margins).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

I'll take a look.

The crash is reproducible with the reduced test case even here:

- refs/heads/master@{#517797}

That version is way before the suspected commit landed. I already had doubts such commit could be the cause of the crash, but this fact confirms it.

BTW, it crashes here in stable (62.0.3202.94).

Still reproduces.

ClusterFuzz has detected this issue as fixed in range 618280:618281.

Detailed report: https://clusterfuzz.com/testcase?key=5800171282890752

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x00000000003d
Crash State:
  blink::InlineBox::LogicalLeft
  blink::RootInlineBox::ClosestLeafChildForLogicalLeftPosition
  blink::LayoutBlockFlow::PositionForPoint
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=508786:508814
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=618280:618281

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5800171282890752

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5800171282890752 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.