Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/ed7a56654a501f4764b5df1fb06f984b0650050b (Introduce StyleTraversalRoot for invalidate/recalc/rebuild.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

 Issue 884449  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/fb3ef9def6a905bf8fd62a0a16ac345ef20c9a0a

commit fb3ef9def6a905bf8fd62a0a16ac345ef20c9a0a
Author: Rune Lillesveen <futhark@chromium.org>
Date: Fri Sep 21 13:46:54 2018

Make sure marking ancestors for reattach updates root correctly.

We used a separate SetChildNeedsReattachLayoutTree() before calling
MarkForWhitespaceReattachment() for the ancestors which meant we passed
a dirty_node/common_ancestor a level higher up the chain which caused
the layout_tree_rebuild_root_ to update incorrectly. Instead use an
arbitrary child to invoke MarkForWhitespaceReattachment() on.

Note that none of the children are actually dirty after a node removal.
We only need to make sure we traverse down to the siblings of a removed
node to check if its whitespace siblings need reattachment.

Since the arbitrary child may be a text node, we have to handle that in
RootElement().

Bug:  884456 ,  884449 
Change-Id: I06c50f6f996e41b813f7e847351fc87d42336857
Reviewed-on: https://chromium-review.googlesource.com/1235997
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Reviewed-by: Anders Ruud <andruud@chromium.org>
Cr-Commit-Position: refs/heads/master@{#593168}
[add] https://crrev.com/fb3ef9def6a905bf8fd62a0a16ac345ef20c9a0a/third_party/WebKit/LayoutTests/fast/css/layout-tree-rebuild-root-crash.html
[modify] https://crrev.com/fb3ef9def6a905bf8fd62a0a16ac345ef20c9a0a/third_party/blink/renderer/core/css/layout_tree_rebuild_root.cc
[modify] https://crrev.com/fb3ef9def6a905bf8fd62a0a16ac345ef20c9a0a/third_party/blink/renderer/core/css/style_engine.cc
[modify] https://crrev.com/fb3ef9def6a905bf8fd62a0a16ac345ef20c9a0a/third_party/blink/renderer/core/css/style_traversal_root.h

ClusterFuzz has detected this issue as fixed in range 593165:593168.

Detailed report: https://clusterfuzz.com/testcase?key=5128658115887104

Fuzzer: bj_broddelwerk
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  blink::LayoutTreeRebuildRoot::RootElement
  blink::StyleEngine::RebuildLayoutTree
  blink::Document::UpdateStyle
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=591303:591304
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=593165:593168

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5128658115887104

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5128658115887104 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.