Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/0dcc66086f58b9e7fcce2de02d01160e237c7e74 ([css-typed-om] Remove StylePropertyMap.getProperties().).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/91057d4c88aeff5e1b372de286e97bc019e31931

commit 91057d4c88aeff5e1b372de286e97bc019e31931
Author: Darren Shen <shend@chromium.org>
Date: Mon Mar 26 07:02:58 2018

[css-typed-om] Fix crash for css-wide keywords in custom properties.

When converting CSSCustomPropertyDeclaration to CSSUnparsedValues, we
used to assume that CSSCustomPropertyDeclaration will always have a
CSSVariableData, but it turns out that css-wide keywords are stored
as a CSSValueID instead of a CSSVariableData.

This patch handles css-wide keywords on CSSUnparsedValues correctly.

We added a unit test and not a WPT since this is likely a blink-only
implementation detail.

Bug:  824740 
Change-Id: Iefbdca4abc736562b81f5c6a3f0332975b842961
Reviewed-on: https://chromium-review.googlesource.com/977141
Commit-Queue: Darren Shen <shend@chromium.org>
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#545729}
[modify] https://crrev.com/91057d4c88aeff5e1b372de286e97bc019e31931/third_party/WebKit/Source/core/BUILD.gn
[modify] https://crrev.com/91057d4c88aeff5e1b372de286e97bc019e31931/third_party/WebKit/Source/core/css/cssom/CSSUnparsedValue.cpp
[modify] https://crrev.com/91057d4c88aeff5e1b372de286e97bc019e31931/third_party/WebKit/Source/core/css/cssom/CSSUnparsedValue.h
[add] https://crrev.com/91057d4c88aeff5e1b372de286e97bc019e31931/third_party/WebKit/Source/core/css/cssom/CSSUnparsedValueTest.cpp
[modify] https://crrev.com/91057d4c88aeff5e1b372de286e97bc019e31931/third_party/WebKit/Source/core/css/cssom/StyleValueFactory.cpp

ClusterFuzz has detected this issue as fixed in range 545728:545729.

Detailed report: https://clusterfuzz.com/testcase?key=5707502055063552

Fuzzer: inferno_twister_c
Job Type: linux_ubsan_vptr_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000018
Crash State:
  blink::CSSUnparsedValue::FromCSSValue
  blink::CreateStyleValueWithProperty
  blink::StyleValueFactory::CssValueToStyleValueVector
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=538031:538033
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=545728:545729

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5707502055063552

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5707502055063552 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.