Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/94335e49e0bde3ca950ac31030841d00a2ec0a3a ([ServiceWorker] Implement ServiceWorkerHost.PostMessageToClient()).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

I can't find the root cause but want to share my findings until now, maybe need Blink>DOM experts to take a look to give some suggestions/hints.. Thanks. 

The suspect CL 
https://chromium.googlesource.com/chromium/src/+/94335e49e0bde3ca950ac31030841d00a2ec0a3a ([ServiceWorker] Implement ServiceWorkerHost.PostMessageToClient())
is only for service worker implementation, it does not touch any code under Source/core/.

There is not any one ServiceWorker related function in the crash stack at  https://clusterfuzz.com/testcase?key=5391473101766656.

The Reproducer Testcase https://clusterfuzz.com/download?testcase_id=5391473101766656 seems does not register/use any Service Workers.

Sorry, unassigning myself for now so this issue can be re-triaged...

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6fa9844e184846daefc97c5af2615ec04fbd9f6f

commit 6fa9844e184846daefc97c5af2615ec04fbd9f6f
Author: Rune Lillesveen <futhark@chromium.org>
Date: Fri Mar 23 18:53:25 2018

Don't store ComputedStyle for display:none elements.

We stored ComputedStyle for option, optgroup, and svg:stop even when
their computed display was none. That caused descendants to get
ComputedStyle objects and confused the WhitespaceAttacher walking down
display:none subtrees for layout tree rebuilds.

Bug:  822581 
Change-Id: I604033d96ff194119f328ac5ced71a9e04563ccb
Reviewed-on: https://chromium-review.googlesource.com/973962
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#545540}
[modify] https://crrev.com/6fa9844e184846daefc97c5af2615ec04fbd9f6f/third_party/WebKit/Source/core/dom/Element.cpp
[modify] https://crrev.com/6fa9844e184846daefc97c5af2615ec04fbd9f6f/third_party/WebKit/Source/core/dom/ElementTest.cpp
[modify] https://crrev.com/6fa9844e184846daefc97c5af2615ec04fbd9f6f/third_party/WebKit/Source/core/html/forms/HTMLOptionElement.cpp
[modify] https://crrev.com/6fa9844e184846daefc97c5af2615ec04fbd9f6f/third_party/WebKit/Source/core/html/forms/HTMLSelectElement.cpp

ClusterFuzz has detected this issue as fixed in range 545539:545541.

Detailed report: https://clusterfuzz.com/testcase?key=5391473101766656

Fuzzer: bj_broddelwerk
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !last_text_node_ in WhitespaceAttacher.cpp
  blink::WhitespaceAttacher::UpdateLastTextNodeFromDisplayContents
  blink::WhitespaceAttacher::ForceLastTextNodeNeedsReattach
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=543326:543327
Fixed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=545539:545541

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5391473101766656

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5391473101766656 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.