Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/ffb5de3934abd4e16399b2f79e7100823c6076fd (Don't propagate cmdline flags that are not read by renderer processes.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

hayato@, could you PTAL?  AFAICT you've introduced the failing DCHECK in https://chromium-review.googlesource.com/c/chromium/src/+/681097/7/third_party/WebKit/Source/core/dom/Element.cpp

I am adding Test-Predator-Wrong-CLs label and removing myself as an owner, because I think the explanation from  https://crbug.com/823148#c3  applies here as well.

It looks this comment [1] is no longer true after we ship custom built-in elements.

[1] https://chromium-review.googlesource.com/c/chromium/src/+/680739/3/third_party/WebKit/Source/core/dom/Element.cpp#2447

We have to update Element::CanAttachShadowRoot so that it rejects custom built-in elements.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/979a7404b634defac35233dc5c396f50b065a6bd

commit 979a7404b634defac35233dc5c396f50b065a6bd
Author: Hayato Ito <hayato@chromium.org>
Date: Thu Mar 22 09:48:45 2018

Reject customized built-in elements in attachShadow

Element::CanAttachShadowRoot() needs to be updated because it returns wrongly true for
customized built-in elements.

The spec: https://dom.spec.whatwg.org/#dom-element-attachshadow

Bug:  823033 
Change-Id: Ia9aeb47569414830f5435f37f85d96101b9fe432
Reviewed-on: https://chromium-review.googlesource.com/970142
Reviewed-by: Koji Ishii <kojii@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Commit-Queue: Hayato Ito <hayato@chromium.org>
Cr-Commit-Position: refs/heads/master@{#545026}
[add] https://crrev.com/979a7404b634defac35233dc5c396f50b065a6bd/third_party/WebKit/LayoutTests/external/wpt/shadow-dom/Element-interface-attachShadow-custom-element.html
[modify] https://crrev.com/979a7404b634defac35233dc5c396f50b065a6bd/third_party/WebKit/Source/core/dom/Element.cpp
[modify] https://crrev.com/979a7404b634defac35233dc5c396f50b065a6bd/third_party/WebKit/Source/core/dom/Node.h

This should be fixed by 979a7404b634defac35233dc5c396f50b065a6bd.

ClusterFuzz has detected this issue as fixed in range 544975:544977.

Detailed report: https://clusterfuzz.com/testcase?key=6551594771152896

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  AreAuthorShadowsAllowed() in Element.cpp
  blink::Element::AttachShadowRootInternal
  blink::Element::attachShadow
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=529050:529051
Fixed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=544975:544977

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6551594771152896

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6551594771152896 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.