Code: Node::InsertionNotificationRequest HTMLLinkElement::InsertedInto(
    ContainerNode& insertion_point) {
  HTMLElement::InsertedInto(insertion_point);
  LogAddElementIfIsolatedWorldAndInDocument("link", relAttr, hrefAttr);
   if (!insertion_point.isConnected())
     return kInsertionDone;
   DCHECK(isConnected());
   if (!ShouldLoadLink() && IsInShadowTree()) {
     String message = "HTML element <link> is ignored in shadow tree.";
     GetDocument().AddConsoleMessage(ConsoleMessage::Create(
         kJSMessageSource, kWarningMessageLevel, message));
     return kInsertionDone;
   }
 
  GetDocument().GetStyleEngine().AddStyleSheetCandidateNode(*this);
   Process();
 
   if (link_)
    link_->OwnerInserted();

  return kInsertionDone;
}

Vulnerability Type: 
CWE ID: CWE-416
Summary: Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Commit Message: Avoid crash when setting rel=stylesheet on <link> in shadow root.

Link elements in shadow roots without rel=stylesheet are currently not
added as stylesheet candidates upon insertion. This causes a crash if
rel=stylesheet is set (and then loaded) later.

R=futhark@chromium.org

Bug: 886753
Change-Id: Ia0de2c1edf43407950f973982ee1c262a909d220
Reviewed-on: https://chromium-review.googlesource.com/1242463
Commit-Queue: Anders Ruud <andruud@chromium.org>
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#593907}