Predator and CL could not provide any possible suspects.

Using Code Search for the file, "flat_tree_traversal_ng.cc" suspecting the below Cl might have caused this issue

Suspect CL: https://chromium.googlesource.com/chromium/src/+/6bc5dffa87430fbe29aa4804db44c0ce1ee4245e%5E%21/third_party/WebKit/Source/core/dom/ng/flat_tree_traversal_ng.cc

hayato@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!

It looks Node::CanStartSelection uses FlatTreeTraversal without updating distribution.

https://chromium.googlesource.com/chromium/src/+/ab3bcd266e7f1000dc0ca7e8798d7b2c62a2d3a5/third_party/WebKit/Source/core/dom/Node.cpp#1143

yoichio@, could you take a look?

Since the case is using createShadowRoot() and execCommand("selectall"),
impact is low.

ClusterFuzz has detected this issue as fixed in range 552588:552589.

Detailed report: https://clusterfuzz.com/testcase?key=5919682364964864

Fuzzer: inferno_twister
Job Type: windows_asan_chrome
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  blink::FlatTreeTraversalNg::TraverseParentForV0
  blink::FlatTreeTraversalNg::TraverseParent
  blink::Node::CanStartSelection
  
Sanitizer: address (ASAN)

Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=552588:552589

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5919682364964864

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5919682364964864 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.