Adding to CC people who have touched the line with the DCHECK (although the changes were mostly refactorings... :-/ ).

Snippet from test logs:

[21865:21865:0401/183741:INFO:CONSOLE(0)] "[SUCCESS] testNavigate", source: chrome-extension://mhjfbmdgcfjbbpaeojofohoefgiehjai/index.html (0)
[21992:22000:0401/183742:FATAL:layer_impl.h(399)] Check failed: !draw_properties_.render_target || draw_properties_.render_target->render_surface().
#0 0x00000063eee1 __interceptor_backtrace
#1 0x0000033ff5a3 base::debug::StackTrace::StackTrace()
#2 0x000003445858 logging::LogMessage::~LogMessage()
#3 0x000011fb4289 cc::draw_property_utils::ComputeLayerDrawProperties()
#4 0x000011fe6a3b cc::CalculateDrawPropertiesInternal()
#5 0x000011fe8010 cc::LayerTreeHostCommon::CalculateDrawProperties()
#6 0x0000120387be cc::LayerTreeImpl::UpdateDrawProperties()
#7 0x000011fef036 cc::LayerTreeHostImpl::CommitComplete()
#8 0x00001229d2a2 cc::ProxyImpl::ScheduledActionCommit()
#9 0x00001224a9bf cc::Scheduler::ProcessScheduledActions()
#10 0x00001224c9d4 cc::Scheduler::NotifyReadyToCommit()
#11 0x00001229436f cc::ProxyImpl::StartCommitOnImpl()
...
#13 0x0000035973a2 base::debug::TaskAnnotator::RunTask()
#14 0x000003459806 base::MessageLoop::RunTask()

I wonder if this is related to https://codereview.chromium.org/1823833002? jaydasika, can you take a look at this?

I don't think my CL is the cause for these flakes as it just changed the treewalk to iterator and it landed more than 1 week back (These flakes are all today).

Since draw_property_utils::ComputeLayerDrawProperties is called only on layers that are in visible_layer_list, https://codereview.chromium.org/1811423002 could be the cause (because it changes what gets into the visible layer list).

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/072c6e44acd50c11ebe83d189de53daaa87a7b9f

commit 072c6e44acd50c11ebe83d189de53daaa87a7b9f
Author: lukasza <lukasza@chromium.org>
Date: Mon Apr 04 20:41:01 2016

Mark PDFExtensionTest.Navigator as flaky on ASAN.

TBR=thestig@chromium.org
BUG= 600445 

Review URL: https://codereview.chromium.org/1859693002

Cr-Commit-Position: refs/heads/master@{#384995}

[modify] https://crrev.com/072c6e44acd50c11ebe83d189de53daaa87a7b9f/chrome/browser/pdf/pdf_extension_test.cc

I have tried to repro this, but I am unable to. My guess is this is because of the early return here (subtree skipping) : 
https://code.google.com/p/chromium/codesearch#chromium/src/cc/trees/layer_tree_host_common.cc&sq=package:chromium&l=661

As we no longer skip subtree in draw_proeprty_utils, it can happen that a layer that was in the subtree that was skipped earlier, is now in visible_layer_list but we don't update its render target because of subtree skippping still happens in layer_tree_host_common. Does that make sense ?

Yes, that's a good theory. One solution would be to walk the visible layer list and clear out all the render_target values before calling CalculateRenderTarget.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4e0cf88dbde39af8b4562a680bcd72c6bf06a72d

commit 4e0cf88dbde39af8b4562a680bcd72c6bf06a72d
Author: jaydasika <jaydasika@chromium.org>
Date: Tue Apr 05 22:18:02 2016

Run PDFExtensionTest.Navigator on ASAN.

BUG= 600445 

Review URL: https://codereview.chromium.org/1862743002

Cr-Commit-Position: refs/heads/master@{#385301}

[modify] https://crrev.com/4e0cf88dbde39af8b4562a680bcd72c6bf06a72d/chrome/browser/pdf/pdf_extension_test.cc