Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4779268985061376

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x0000bfff8000
Crash State:
  blink::EventTarget::fireEventListeners
  blink::EventTarget::fireEventListeners
  blink::EventDispatcher::dispatch
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=410031:410228

Minimized Testcase (0.39 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95zk_vuOHnj0ajQv9mHbjMfSaJDMSsmsORso8x-_989IklDM5-WR7_1lo1Ct8M5uTe4To3SI4z61xcnGKMo83I7lxbcvO_WGJK4Oduoeh2ogI4qSh6e9eHSLNPk2emXGWFacz3hKFpRDCaVEYGDTrT0opnZjA?testcase_id=4779268985061376
<script>
function fuzz() {
  document.getElementById("listbox_option_enabled").addEventListener(
      "pointerdown", function() { try {; } catch (e) {}
 });
  e = document.createEvent("Event");
  var element = document.getElementById("listbox_option_enabled");
  e.initEvent("pointerdown");
  element.dispatchEvent(e);
}
 setTimeout(fuzz); </script>
<optgroup>
    <option id="listbox_option_enabled">


Issue manually filed by: mbarbella

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.