Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/e7c12ca34b1b205f77fbaa2e6c6638ccb364f123 (Check script setting before invoking the mutation observer handler.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9a56b451f20b2ec15b8362b35537813611c80232

commit 9a56b451f20b2ec15b8362b35537813611c80232
Author: Johnny(Jianning) Ding <jnd@chromium.org>
Date: Wed Jun 20 12:38:26 2018

Add script setting check in IsCallbackFunctionRunnable.

The incumbent realm schedules the currently-running callback although
it may not correspond to the currently-running function object.
The goal for this CL to is check whether the script setting is disabled
before invoking JS callback, then checking the context which originally
schedules the current-running callback seems to make more sense.

Please notice that this CL changes the behavior of the method
IsCallbackFunctionRunnable to require the execution context of the
incumbent environment to be not empty, not paused and enabled for
JavaScript.

Bug:  849600 , 849601 , 849730 , 848086 , 849915 , 851357 
Change-Id: Id8ab0f9f67f9602635b295b414d2d0026c87e4ab
Reviewed-on: https://chromium-review.googlesource.com/1087536
Commit-Queue: Johnny Ding <jnd@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Yuki Shiino <yukishiino@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#568799}
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/WebKit/LayoutTests/inspector-protocol/page/not-invoke-mutation-observer-after-script-disabled-expected.txt
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/WebKit/LayoutTests/inspector-protocol/page/not-invoke-mutation-observer-after-script-disabled.js
[add] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/WebKit/LayoutTests/inspector-protocol/resources/mutation-observer-triggered-by-parser.html
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/core/v8/generated_code_helper.cc
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/core/v8/generated_code_helper.h
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/templates/callback_function.cpp.tmpl
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/templates/callback_interface.cpp.tmpl
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/tests/results/core/v8_any_callback_function_optional_any_arg.cc
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/tests/results/core/v8_long_callback_function.cc
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/tests/results/core/v8_string_sequence_callback_function_long_sequence_arg.cc
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/tests/results/core/v8_test_callback_interface.cc
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/tests/results/core/v8_test_legacy_callback_interface.cc
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/tests/results/core/v8_void_callback_function.cc
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/tests/results/core/v8_void_callback_function_dictionary_arg.cc
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/tests/results/core/v8_void_callback_function_enum_arg.cc
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/tests/results/core/v8_void_callback_function_interface_arg.cc
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/tests/results/core/v8_void_callback_function_test_interface_sequence_arg.cc
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/tests/results/core/v8_void_callback_function_typedef.cc
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/bindings/tests/results/modules/v8_void_callback_function_modules.cc
[modify] https://crrev.com/9a56b451f20b2ec15b8362b35537813611c80232/third_party/blink/renderer/core/dom/mutation_observer.cc

ClusterFuzz has detected this issue as fixed in range 568798:568824.

Detailed report: https://clusterfuzz.com/testcase?key=6210892719718400

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000058
Crash State:
  chrome
  blink::LocalFrame::Client
  blink::LocalFrame::GetContentSettingsClient
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=564281:564322
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=568798:568824

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6210892719718400

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6210892719718400 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.