Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/822be90274eab3c047fea8cf2d7dd35cd5d0db49 (Enable slot-in-flat-tree flag in stable.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

https://chromium-review.googlesource.com/c/chromium/src/+/1113339

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/08888da04903dd73887abe4d5f625e750b959bd3

commit 08888da04903dd73887abe4d5f625e750b959bd3
Author: Rune Lillesveen <futhark@chromium.org>
Date: Mon Jun 25 16:30:49 2018

Don't treat option/optgroup as display:contents.

We should reset last text node seen by the whitespace attacher when
entering an option or optgroup element. We normally do that when we see
a layout object, but these element do not have layout objects. We
incorrectly treated them as display:contents during layout tree
rebuild.

This caused a fuzzer DCHECK failure in WhitespaceAttacher where we did
not reset the WhitespaceAttacher for an optgroup which we thought were
a display:contents but not registered as one in the WhitespaceAttacher.

Bug:  855949 
Change-Id: I5c341a3f47a4e76216db6f712ecacfc939b5f7fa
Reviewed-on: https://chromium-review.googlesource.com/1113339
Reviewed-by: Anders Ruud <andruud@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#570058}
[add] https://crrev.com/08888da04903dd73887abe4d5f625e750b959bd3/third_party/WebKit/LayoutTests/fast/css/recalc-optgroup-as-iframe-child-crash.html
[modify] https://crrev.com/08888da04903dd73887abe4d5f625e750b959bd3/third_party/blink/renderer/core/dom/element.cc

ClusterFuzz has detected this issue as fixed in range 570057:570069.

Detailed report: https://clusterfuzz.com/testcase?key=5196859178745856

Fuzzer: attekett_dom_fuzzer
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !last_text_node_ in whitespace_attacher.cc
  blink::WhitespaceAttacher::UpdateLastTextNodeFromDisplayContents
  blink::WhitespaceAttacher::ForceLastTextNodeNeedsReattach
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=540771:540772
Fixed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=570057:570069

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5196859178745856

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5196859178745856 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.