Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/d35b92b9d21b2d299fdddaf07c3bcb0e32a0b16d (Merge EventQueueImpl into EventQueue).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

Confirmed

Before this crash, another DCHECK error happens?

[1:1:0625/150457.033158:FATAL:slot_assignment.cc(222)] Check failed: !owner_->GetDocument().IsSlotAssignmentRecalcForbidden().
#0 0x7f782a1c20bc base::debug::StackTrace::StackTrace()
#1 0x7f782a10b64b logging::LogMessage::~LogMessage()
#2 0x7f7821d567da blink::SlotAssignment::RecalcAssignment()
#3 0x7f782215569d blink::HTMLSlotElement::AssignedNodeNextTo()
#4 0x7f7821e2d8ba blink::FlatTreeTraversal::Next()
#5 0x7f7821e286d8 blink::NextLayoutObjectOnFlatTree()
#6 0x7f7821e28d67 blink::ResetOldSelectedLayoutObjects()
#7 0x7f7821e28a9c blink::LayoutSelection::ClearSelection()
#8 0x7f7822437751 blink::LayoutView::ClearSelection()
#9 0x7f78223dde6d blink::LayoutObjectChildList::RemoveChildNode()
#10 0x7f78223cb8c2 blink::LayoutObject::RemoveChild()
#11 0x7f782233c275 blink::LayoutBlockFlow::RemoveChild()
#12 0x7f78223d8f24 blink::LayoutObject::WillBeDestroyed()
#13 0x7f782236f864 blink::LayoutBoxModelObject::WillBeDestroyed()
#14 0x7f782235180c blink::LayoutBox::WillBeDestroyed()
#15 0x7f78223a71de blink::LayoutImage::WillBeDestroyed()
#16 0x7f78223d9f82 blink::LayoutObject::Destroy()
#17 0x7f78223d9f41 blink::LayoutObject::DestroyAndCleanupAnonymousWrappers()
#18 0x7f7821d18a02 blink::Node::DetachLayoutTree()
#19 0x7f7821c53db8 blink::ContainerNode::DetachLayoutTree()
#20 0x7f7821cbbf5f blink::Element::DetachLayoutTree()
#21 0x7f7822156233 blink::HTMLSlotElement::DetachLayoutTree()
#22 0x7f7821c53d9f blink::ContainerNode::DetachLayoutTree()
#23 0x7f7821cbbf5f blink::Element::DetachLayoutTree()
#24 0x7f7821c53d9f blink::ContainerNode::DetachLayoutTree()
#25 0x7f7821d4eb25 blink::ShadowRoot::DetachLayoutTree()
#26 0x7f7821cbbf54 blink::Element::DetachLayoutTree()
#27 0x7f7821c52ca9 blink::ContainerNode::RemoveBetween()
#28 0x7f7821c51bcf blink::ContainerNode::RemoveChild()
#29 0x7f7821c4fa46 blink::CollectChildrenAndRemoveFromOldParent()
#30 0x7f7821c4f711 blink::ContainerNode::AppendChild()
#31 0x7f7821d152f8 blink::Node::appendChild()
#32 0x7f782294c847 blink::V8Node::appendChildMethodCallbackForMainWorld()
#33 0x7f782320a984 v8::internal::FunctionCallbackArguments::Call()
#34 0x7f7823208d20 v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
#35 0x7f78232070f8 v8::internal::Builtin_Impl_HandleApiCall()
#36 0x7f7823206b3d v8::internal::Builtin_HandleApiCall()
#37 0x7f7823ec1eb5 <unknown>

Hayato-san, could you take a look? Even with the latest build, the crash at comment #4 happens instead of the crash cluster-fuzz reported.

I think yoichio@ might want to take a look.

Given that https://chromium.googlesource.com/chromium/src/+/deb6bb60b6d562719d04c6a564717b332d9c55bd is in the range.

yoichio@, can this issue be merged to the issue you are working on?

ClusterFuzz has detected this issue as fixed in range 571074:571092.

Detailed report: https://clusterfuzz.com/testcase?key=4962939690549248

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  blink::Node::GetStyleChangeType
  blink::Node::NeedsAttach
  blink::Node::LazyReattachIfAttached
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=569160:569178
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=571074:571092

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4962939690549248

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.