ClusterFuzz has detected this issue as fixed in range 618785:618787.

Detailed report: https://clusterfuzz.com/testcase?key=6323032429428736

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !frame_ || frame_->Tree().ChildCount() == 0 in document.cc
  blink::Document::Shutdown
  blink::XSLTProcessor::CreateDocumentFromSource
  
Sanitizer: memory (MSAN)

Fixed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=618785:618787

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6323032429428736

See https://www.chromium.org/developers/testing/memorysanitizer#TOC-Reproducing-ClusterFuzz-Bugs for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6323032429428736 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.