GitLab

The problem was here:

for (size_t i = children().size() - 1; i >= 0; --i) {

The loop variable |size_t i| was of an unsigned int type, so |i >= 0|
was always true.

Repro on Windows by exploring the tree with Inspect on the link provided
in the crbug description.

Bug: 988153
Change-Id: I1cae093da68f12ed1630a568ec7529703c73cf89
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1737870
Commit-Queue: Benjamin Beaudry <benjamin.beaudry@microsoft.com>
Reviewed-by: Aaron Leventhal <aleventhal@chromium.org>
Reviewed-by: Nektarios Paisios <nektar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#684428}