[Webkit-unassigned] [Bug 106203] New: [Shadow DOM]: crash in WebCore::ElementShadow::setValidityUndetermined

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=106203

           Summary: [Shadow DOM]: crash in
                    WebCore::ElementShadow::setValidityUndetermined
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: tasak at google.com


Detailed report: https://cluster-fuzz.appspot.com/testcase?key=151773592

Fuzzer: Webcomponents_fuzzer

Crash Type: UNKNOWN
Crash Address: 0x000000000028
Crash State:
  - crash stack -
  WebCore::ElementShadow::setValidityUndetermined
  WebCore::InsertionPoint::insertedInto
  WebCore::ChildNodeInsertionNotifier::notifyNodeInsertedIntoTree

Regressed: https://cluster-fuzz.appspot.com/revisions?range=172434:172624

Minimized Testcase (14.93 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96qsWtbBREqcvnVZLzeb1hqnpJdPv11ntaNeWQvD55iVBhetKZnBKcu-vVDLfWrjeDJJ6ECsJdX722HqN6PTtrSXfe5ku2petIQc_u47mLS6YEg6q7QXY2eJ8E8OL5LciBp1HKK2fXwrQqQ_o4rOPwApEFzxRnjj83ER5Sux8IO0DYIa3I

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.