From findit tool:

Author: jww@chromium.org
Project: chromium-blink
Changelist: https://chromium.googlesource.com/chromium/blink.git/+/fb8b90923f07241042ff3a9b3e277b369a100b00
Time: Fri Mar 27 03:36:14 2015
File ScriptLoader.cpp is changed in this cl (and is part of stack frame #1, "isHTMLScriptLoader"; frame #2, "blink::toScriptLoaderIfPossible")
Minimum distance from crash line to modified line: 2. (file: ScriptLoader.cpp, crashed on: 340, modified: 342).

Suspected Project: chromium-blink
Suspected Component: Blink>DOM

Through code search on file ScriptLoader.cpp suspected CL is 
https://chromium.googlesource.com/chromium/src/+/cb7d218fb4605744596dbb2b722f3e8934227093

This is  issue 624321  etc all over again.

ClusterFuzz has detected this issue as fixed in range 402095:402107.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6241760900808704

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000010
Crash State:
  blink::toScriptLoaderIfPossible
  blink::HTMLScriptRunner::runScript
  blink::HTMLScriptRunner::execute
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=322535:322541
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=402095:402107

Minimized Testcase (0.48 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv976dtghKgjoAqGF_cYJj8c-hZBiHmWwlp5ytDjNAPSFLhRfXzI5yyN1i9dQARy9LzcsDBDI1cp8YTjrHSt9gs6hE8UF1rHvTf6m6VMnbu6so-NV_CPu_ESJS1Ti2ZPAIzNFV99_GcTlwqExOVIfNp5SufFOeg?testcase_id=6241760900808704
<style>
@import url(N#Va_=l|3M&amp;</style>
<script>
function eventhandler8() {
 /*Document*/ var var00102 = document;  //line 111
 /*Node*/ var var00103 = var00102;  //line 112
 /*HTMLDocument*/ var var00267 = document;  //line 303
 /*XMLSerializer*/ var var00268 = new XMLSerializer();  //line 304
 /*DOMString*/ var var00269 = var00268.serializeToString(var00103);  //line 305
 var00267.writeln(var00269);  //line 306
}
</script>
<style onload=eventhandler8()></style>
<iframe id=tCF2</iframe>


Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot