Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/9626ac98ec0cfee6c72e812302576b6aa28bca6c ([SPv175+] Combine series of rectangular clips in the same transform space).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

With DCHECK enabled, the test will crash at

DevTools listening on ws://127.0.0.1:41619/devtools/browser/44c358ee-3e94-424c-8366-41b651edda8c
[1:1:0226/094620.783169:FATAL:SVGMaskPainter.cpp(53)] Check failed: properties && properties->Mask(). 
#0 0x000003388a7c base::debug::StackTrace::StackTrace()
#1 0x0000033a791c logging::LogMessage::~LogMessage()
#2 0x000005a7b9eb blink::SVGMaskPainter::FinishEffect()
#3 0x000005a7a45f blink::SVGPaintContext::~SVGPaintContext()
#4 0x000005a7da9f blink::SVGRootPainter::PaintReplaced()
#5 0x0000058e0695 blink::LayoutSVGRoot::PaintReplaced()
#6 0x000005a757e9 blink::ReplacedPainter::Paint()
#7 0x0000057c77b5 blink::LayoutReplaced::Paint()
#8 0x000005a113ad blink::ObjectPainter::PaintAllPhasesAtomically()
#9 0x0000059dc771 blink::BlockPainter::PaintInlineBox()
#10 0x000005a028af blink::InlineFlowBoxPainter::Paint()
#11 0x00000585a295 blink::InlineFlowBox::Paint()
#12 0x000005a75d05 blink::RootInlineBoxPainter::Paint()
#13 0x00000586ffd5 blink::RootInlineBox::Paint()
#14 0x000005a09cb1 blink::LineBoxListPainter::Paint()
#15 0x0000059ddb58 blink::BlockFlowPainter::PaintContents()
#16 0x0000059dd436 blink::BlockPainter::PaintObject()
#17 0x0000056edea5 blink::LayoutBlock::PaintObject()
#18 0x0000059dbad8 blink::BlockPainter::Paint()
#19 0x0000056ede65 blink::LayoutBlock::Paint()
#20 0x0000059dc484 blink::BlockPainter::PaintChildren()
#21 0x0000056ede85 blink::LayoutBlock::PaintChildren()

This seems similar to the previous bug about mask for which chrishtr@ created a workaround.

 Issue 816349  has been merged into this issue.

 Issue 814786  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 539400:539401.

Detailed report: https://clusterfuzz.com/testcase?key=6325073733222400

Fuzzer: miaubiz_svg_fuzzer
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000008
Crash State:
  blink::LowestCommonAncestor
  SwitchToEffect
  blink::GraphicsLayer::PaintContents
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=539059:539060
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=539400:539401

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6325073733222400

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.