Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/b6ec484f7d3153135b9640117a89252ff45829b8 (Launch Incremental Shadow DOM).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

- I can repro the crash *without* Incrmental Shadow DOM enabled.
- Actually, I could repro the crash even before I enabled Incremental Shadow DOM flag experimental.

editing-dev@, yosin@

Could you take a look? The repro case is very simple.

The stacktrace when I could repro the crash is:

DevTools listening on ws://127.0.0.1:43053/devtools/browser/1a3c242b-d5af-450a-ac23-ab4c098ef087
[100506:100506:0521/105045.163823:FATAL:selection_adjuster.cc(741)] Check failed: false.
#0 0x7f9c548b9bfc base::debug::StackTrace::StackTrace()
#1 0x7f9c547fab1b logging::LogMessage::~LogMessage()
#2 0x7f9c4e6a8219 blink::EditingBoundaryAdjuster::AdjustSelectionToAvoidCrossingEditingBoundaries<>()
#3 0x7f9c4e6a4ccd blink::SelectionAdjuster::AdjustSelectionToAvoidCrossingEditingBoundaries()
#4 0x7f9c4e6e856f blink::VisibleSelectionTemplate<>::CreateWithGranularity()
#5 0x7f9c4e6e82e0 blink::CreateVisibleSelection()
#6 0x7f9c4e6ae8e4 blink::SelectionEditor::UpdateCachedVisibleSelectionInFlatTreeIfNeeded()
#7 0x7f9c4e6ae585 blink::SelectionEditor::ComputeVisibleSelectionInFlatTree()
#8 0x7f9c4e65cd7e blink::FrameSelection::SelectionHasFocus()
#9 0x7f9c4e65d015 blink::FrameSelection::IsHidden()
#10 0x7f9c4e682e79 blink::LayoutSelection::Commit()
#11 0x7f9c4eca0501 blink::LayoutView::CommitPendingSelection()
#12 0x7f9c4eea5819 blink::PaintLayerCompositor::UpdateIfNeededRecursiveInternal()
#13 0x7f9c4eea5365 blink::PaintLayerCompositor::UpdateIfNeededRecursive()
#14 0x7f9c4e821156 blink::LocalFrameView::UpdateLifecyclePhasesInternal()
#15 0x7f9c4e820d07 blink::LocalFrameView::UpdateAllLifecyclePhases()
#16 0x7f9c4ee4022e blink::PageAnimator::UpdateAllLifecyclePhases()
#17 0x7f9c4e762fa8 blink::WebViewImpl::UpdateLifecycle()
#18 0x7f9c4e889f08 blink::WebViewFrameWidget::UpdateLifecycle()
#19 0x7f9c53ea3942 content::RenderWidget::UpdateVisualState()
#20 0x7f9c52483b38 cc::ProxyMain::BeginMainFrame()
#21 0x7f9c524823ef _ZN4base8internal12InvokeHelperILb1EvE8MakeItSoIMN2cc9ProxyMainEFvNSt3__110unique_ptrINS4_28BeginMainFrameAndCommitStateENS6_14default_deleteIS8_EEEEENS_7WeakPtrIS5_EEJSB_EEEvOT_OT0_DpOT1_
#22 0x7f9c524822be _ZN4base8internal7InvokerINS0_9BindStateIMN2cc9ProxyMainEFvNSt3__110unique_ptrINS3_28BeginMainFrameAndCommitStateENS5_14default_deleteIS7_EEEEEJNS_7WeakPtrIS4_EENS0_13PassedWrapperISA_EEEEEFvvEE7RunOnceEPNS0_13BindStateBaseE
#23 0x7f9c547daf80 base::debug::TaskAnnotator::RunTask()
#24 0x7f9c4d0f1a9d base::sequence_manager::internal::ThreadControllerImpl::DoWork()
#25 0x7f9c4d0f3b28 _ZN4base8internal7InvokerINS0_9BindStateIMNS_16sequence_manager8internal20ThreadControllerImplEFvNS4_19SequencedTaskSource8WorkTypeEEJNS_7WeakPtrIS5_EES7_EEEFvvEE3RunEPNS0_13BindStateBaseE
#26 0x7f9c547daf80 base::debug::TaskAnnotator::RunTask()
#27 0x7f9c548071b6 base::internal::IncomingTaskQueue::RunTask()
#28 0x7f9c5480ac57 base::MessageLoop::RunTask()
#29 0x7f9c5480b06a base::MessageLoop::DeferOrRunPendingTask()
#30 0x7f9c5480b2fe base::MessageLoop::DoWork()
#31 0x7f9c5480d636 base::MessagePumpDefault::Run()
#32 0x7f9c5480a581 base::MessageLoop::Run()
#33 0x7f9c5483e376 base::RunLoop::Run()
#34 0x7f9c53eb14d1 content::RendererMain()
#35 0x7f9c53f8c3d1 content::RunZygote()
#36 0x7f9c53f8cd2a content::RunOtherNamedProcessTypeMain()
#37 0x7f9c53f8da44 content::ContentMainRunnerImpl::Run()
#38 0x7f9c506e96c5 service_manager::Main()
#39 0x7f9c53f8b884 content::ContentMain()
#40 0x0000002ef149 main
#41 0x7f9c4a8ec2b1 __libc_start_main
#42 0x0000002ef02a _start

ClusterFuzz has detected this issue as fixed in range 560954:560959.

Detailed report: https://clusterfuzz.com/testcase?key=5806449507434496

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000011
Crash State:
  blink::Node::MayContainLegacyNodeTreeWhereDistributionShouldBeSupported
  blink::Node::UpdateDistributionInternal
  UpdateDistributionForFlatTreeTraversal
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=559423:559424
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=560954:560959

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5806449507434496

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Lower to Pri-3 since this is caused by unusual HTML.

ClusterFuzz testcase 5806449507434496 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.