Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/ecde43d3de87b7ad6b15be5677ad5f0ac53aad2c ([SP] Make filtered elements containers for out of flow positioned elements).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Friendly ping! :) +some more Blink>Layout OWNERS.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/36591a087ea7c809e04bf4ffd0730009a4f7167f

commit 36591a087ea7c809e04bf4ffd0730009a4f7167f
Author: Morten Stenshorne <mstensho@chromium.org>
Date: Thu Jun 07 08:47:39 2018

Correctly detect when a multicol descendant becomes or ceases to be a containing block.

When a descendant of a multicol container becomes a containing block for
out-of-flow positioned objects, or ceases to be one, out-of-flow
positioned children may become or cease to be a part of the
fragmentation context.

We didn't detect this correctly. We only checked for transforms (in
addition to position:relative). Make sure we check for filters too, now
that those also establish containing blocks.

Bug:  847328 
Change-Id: I7ab47860bb8d9f8d9b0256b25e1123c34f73e8f4
Reviewed-on: https://chromium-review.googlesource.com/1089336
Reviewed-by: Emil A Eklund <eae@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#565210}
[add] https://crrev.com/36591a087ea7c809e04bf4ffd0730009a4f7167f/third_party/WebKit/LayoutTests/external/wpt/css/css-multicol/filter-with-abspos.html
[modify] https://crrev.com/36591a087ea7c809e04bf4ffd0730009a4f7167f/third_party/blink/renderer/core/layout/layout_multi_column_flow_thread.cc

This bug requires manual review: M68 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), kariahda@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz has detected this issue as fixed in range 565209:565210.

Detailed report: https://clusterfuzz.com/testcase?key=4621265831460864

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Security DCHECK failure
Crash Address: 
Crash State:
  !object || (object->IsLayoutMultiColumnSet()) in layout_multi_column_set.h
  blink::LayoutMultiColumnFlowThread::FlowThreadDescendantWillBeRemoved
  blink::LayoutObject::RemoveFromLayoutFlowThreadRecursive
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=556633:556634
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=565209:565210

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4621265831460864

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4621265831460864 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug requires manual review: M68 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), kariahda@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Please specify which OS's this is impacting, so merge request can be appropriately routed. 

This impacts all OSes that use Blink. I removed a lot of OS labels in #c9, because it essentially affects everyone. Was that wrong?

Thanks for more details. Approving merge for M68. Branch:3440

Yes, please make sure to add labels for all affected OS's. Otherwise, this may not get routed to the appropriate team. Adding all the labels back. 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0658c49bd42c2a570cbc182ee233f396e84ebf9f

commit 0658c49bd42c2a570cbc182ee233f396e84ebf9f
Author: Morten Stenshorne <mstensho@chromium.org>
Date: Tue Jun 12 20:55:46 2018

Correctly detect when a multicol descendant becomes or ceases to be a containing block.

When a descendant of a multicol container becomes a containing block for
out-of-flow positioned objects, or ceases to be one, out-of-flow
positioned children may become or cease to be a part of the
fragmentation context.

We didn't detect this correctly. We only checked for transforms (in
addition to position:relative). Make sure we check for filters too, now
that those also establish containing blocks.

Bug:  847328 
Change-Id: I7ab47860bb8d9f8d9b0256b25e1123c34f73e8f4
Reviewed-on: https://chromium-review.googlesource.com/1089336
Reviewed-by: Emil A Eklund <eae@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#565210}(cherry picked from commit 36591a087ea7c809e04bf4ffd0730009a4f7167f)
Reviewed-on: https://chromium-review.googlesource.com/1097955
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/branch-heads/3440@{#321}
Cr-Branched-From: 010ddcfda246975d194964ccf20038ebbdec6084-refs/heads/master@{#561733}
[add] https://crrev.com/0658c49bd42c2a570cbc182ee233f396e84ebf9f/third_party/WebKit/LayoutTests/external/wpt/css/css-multicol/filter-with-abspos.html
[modify] https://crrev.com/0658c49bd42c2a570cbc182ee233f396e84ebf9f/third_party/blink/renderer/core/layout/layout_multi_column_flow_thread.cc

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot