Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/4766c5012f46eed5afec44dcbc10e7365eadbc1b (Merge anonymous table boxes when appropriate.).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

The minimized clusterfuzz case crashes Chrome 63.0.3239.132 as well. It might be that we got a different call-stack when the suspected CL was in, but it's been reverted and I can still reproduce this on trunk.

This must be an older issue.

Oh. Sorry, I thought it was the table correction change. This is display:contents. I had display:contents enabled in my 63, which explains why I could reproduce there.

Smaller testcase attached.

Deleted: contentscrash.html 375 bytes

contentscrash.html 375 bytes View Download

Smaller testcase attached.

Deleted: contentscrash.html 269 bytes

contentscrash.html 269 bytes View Download

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5d0f1f9834c1bb63757210f0d6dbc75be35399e8

commit 5d0f1f9834c1bb63757210f0d6dbc75be35399e8
Author: Rune Lillesveen <futhark@chromium.org>
Date: Wed Jan 10 14:00:58 2018

Do not propagate style from parent box to anonymous inline wrappers.

Anonymous inline wrappers are used for display:contents. They should get
their inherited computed style from the display:contents element, not
the closest LayoutObject ancestor. This caused inconsistent white-space
properties causing a broken line box tree and crashes.

Bug:  799719 
Change-Id: Ia2c4a3c037fa7f56b238de3a63797346bf5b3fff
Reviewed-on: https://chromium-review.googlesource.com/859438
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#528300}
[add] https://crrev.com/5d0f1f9834c1bb63757210f0d6dbc75be35399e8/third_party/WebKit/LayoutTests/external/wpt/css/css-display/display-contents-text-inherit-002.html
[modify] https://crrev.com/5d0f1f9834c1bb63757210f0d6dbc75be35399e8/third_party/WebKit/Source/core/layout/LayoutInline.h

ClusterFuzz has detected this issue as fixed in range 528288:528303.

Detailed report: https://clusterfuzz.com/testcase?key=5943140963057664

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x00000000003d
Crash State:
  chrome
  blink::InlineBox::LogicalLeft
  blink::RootInlineBox::ClosestLeafChildForLogicalLeftPosition
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=526966:526980
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=528288:528303

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5943140963057664

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5943140963057664 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.