Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/79925868d14e19bb4bfb38d09bdd6565c8f4c9a1 (Don't recalc assignement in HTMLSlotElement::DetachLayoutTree).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

 Issue 846458  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2ff81cbf1dab9e224f3252be810c820c480e4922

commit 2ff81cbf1dab9e224f3252be810c820c480e4922
Author: Hayato Ito <hayato@chromium.org>
Date: Mon May 28 03:16:54 2018

Check all pending slot assignment recalc in a tree of trees, instead of a shadow tree

Fix the crash reported by cluster fuzz ( https://crbug.com/846449 ).

The fix of https://crrev.com/c/1068646 was not enough. We need to check all pending slot
assignment recalc in a tree of trees because an enclosing list of a list item can be
in another node tree.

Bug:  776656 , 846449 
Change-Id: I559e9f7fbe6c7cd8a54ac9ab3e7e3faec5d4294c
Reviewed-on: https://chromium-review.googlesource.com/1073211
Commit-Queue: Hayato Ito <hayato@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#562174}
[add] https://crrev.com/2ff81cbf1dab9e224f3252be810c820c480e4922/third_party/WebKit/LayoutTests/shadow-dom/crashes/list-item-delete-crash.html
[modify] https://crrev.com/2ff81cbf1dab9e224f3252be810c820c480e4922/third_party/blink/renderer/core/dom/document.cc
[modify] https://crrev.com/2ff81cbf1dab9e224f3252be810c820c480e4922/third_party/blink/renderer/core/dom/document.h
[modify] https://crrev.com/2ff81cbf1dab9e224f3252be810c820c480e4922/third_party/blink/renderer/core/dom/ng/slot_assignment_engine.h
[modify] https://crrev.com/2ff81cbf1dab9e224f3252be810c820c480e4922/third_party/blink/renderer/core/dom/node.cc
[modify] https://crrev.com/2ff81cbf1dab9e224f3252be810c820c480e4922/third_party/blink/renderer/core/dom/node.h
[modify] https://crrev.com/2ff81cbf1dab9e224f3252be810c820c480e4922/third_party/blink/renderer/core/html/list_item_ordinal.cc

ClusterFuzz has detected this issue as fixed in range 562173:562174.

Detailed report: https://clusterfuzz.com/testcase?key=4656836884824064

Fuzzer: marty_html_twiddler
Job Type: linux_ubsan_vptr_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::Node::LazyReattachIfAttached
  blink::HTMLSlotElement::DetachLayoutTree
  blink::ContainerNode::DetachLayoutTree
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=561370:561371
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=562173:562174

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4656836884824064

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4656836884824064 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Requested merge to 68 over on  issue 847012 

Merge to 68 has been approved over on  issue 847012  - mind doing the honours 	hayato@?

We don't need to merge this to M68.
This fix makes sense only if IncrementalShadowDOM flag is enabled.
The flag is not enabled on M68.