Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/ed7a56654a501f4764b5df1fb06f984b0650050b (Introduce StyleTraversalRoot for invalidate/recalc/rebuild.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/fb3ef9def6a905bf8fd62a0a16ac345ef20c9a0a

commit fb3ef9def6a905bf8fd62a0a16ac345ef20c9a0a
Author: Rune Lillesveen <futhark@chromium.org>
Date: Fri Sep 21 13:46:54 2018

Make sure marking ancestors for reattach updates root correctly.

We used a separate SetChildNeedsReattachLayoutTree() before calling
MarkForWhitespaceReattachment() for the ancestors which meant we passed
a dirty_node/common_ancestor a level higher up the chain which caused
the layout_tree_rebuild_root_ to update incorrectly. Instead use an
arbitrary child to invoke MarkForWhitespaceReattachment() on.

Note that none of the children are actually dirty after a node removal.
We only need to make sure we traverse down to the siblings of a removed
node to check if its whitespace siblings need reattachment.

Since the arbitrary child may be a text node, we have to handle that in
RootElement().

Bug:  884456 ,  884449 
Change-Id: I06c50f6f996e41b813f7e847351fc87d42336857
Reviewed-on: https://chromium-review.googlesource.com/1235997
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Reviewed-by: Anders Ruud <andruud@chromium.org>
Cr-Commit-Position: refs/heads/master@{#593168}
[add] https://crrev.com/fb3ef9def6a905bf8fd62a0a16ac345ef20c9a0a/third_party/WebKit/LayoutTests/fast/css/layout-tree-rebuild-root-crash.html
[modify] https://crrev.com/fb3ef9def6a905bf8fd62a0a16ac345ef20c9a0a/third_party/blink/renderer/core/css/layout_tree_rebuild_root.cc
[modify] https://crrev.com/fb3ef9def6a905bf8fd62a0a16ac345ef20c9a0a/third_party/blink/renderer/core/css/style_engine.cc
[modify] https://crrev.com/fb3ef9def6a905bf8fd62a0a16ac345ef20c9a0a/third_party/blink/renderer/core/css/style_traversal_root.h

ClusterFuzz has detected this issue as fixed in range 593165:593169.

Detailed report: https://clusterfuzz.com/testcase?key=5606844557688832

Fuzzer: puzzor
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  chrome
  blink::LayoutTreeRebuildRoot::RootElement
  blink::StyleEngine::RebuildLayoutTree
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=591302:591304
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_chrome&range=593165:593169

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5606844557688832

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.