ClusterFuzz has detected this issue as fixed in range 560941:560959.

Detailed report: https://clusterfuzz.com/testcase?key=4505325672333312

Fuzzer: bj_broddelwerk
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0xd0c5c10ed8140000
Crash State:
  Bad-cast to blink::LayoutObject from invalid vptr
  blink::LayoutBlockFlow::RemoveChild
  blink::LayoutObject::WillBeDestroyed
  
Sanitizer: cfi (CFI)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=559420:559432
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=560941:560959

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4505325672333312

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Very likely dupe of Issue 844277 which has the same regression range and which was fixed in the Fixed range.

Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

ClusterFuzz testcase 4505325672333312 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot