From findit tool:

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/99de02ba952b0a69291f81c5b8ca14d81cc1f74f
Time: Fri Jul 01 05:54:12 2016
The CL last changed line 214 of file bind_internal.h, which is stack frame 4.

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/99de02ba952b0a69291f81c5b8ca14d81cc1f74f
Time: Fri Jul 01 05:54:12 2016
The CL last changed line 303 of file bind_internal.h, which is stack frame 5.

frame() or frame().document() was probably null in the SpellCheckRequester::didCheckSucceed().

yoshin: Could you handle this?

 Issue 638769  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8d1974aecc77d407a9ee89d2434f0079b4cc1e40

commit 8d1974aecc77d407a9ee89d2434f0079b4cc1e40
Author: xiaochengh <xiaochengh@chromium.org>
Date: Wed Aug 24 02:15:54 2016

Force expandToParagraphBoundary to return a valid EphemeralRange

This is a first-aid patch that make expandToParagraphBoundary()
compare the paragraph boundaries found with the input range before
returning, so that the returned range is always a super-range of
the input range, and hence, a valid EphemeralRange.

This patch does not fix the root cause of the bugs, as we:
- do not expect startOfParagraph()'s return value to be beyond that of
endOfParagraph()'s, and
- are planning of getting rid of TextCheckingParagraph, the only client
of expandToParagraphBoundary(), ultimately

BUG= 639521 ,  639801 ,  640022 ,  640030 ,  640112 
TEST=n/a; this is a first-aid patch

Review-Url: https://codereview.chromium.org/2271603002
Cr-Commit-Position: refs/heads/master@{#413942}

[modify] https://crrev.com/8d1974aecc77d407a9ee89d2434f0079b4cc1e40/third_party/WebKit/Source/core/editing/spellcheck/TextCheckingParagraph.cpp

ClusterFuzz has detected this issue as fixed in range 413791:414128.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6241097116549120

Fuzzer: bj_broddelwerk
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000009
Crash State:
  blink::SpellCheckRequester::didCheckSucceed
  blink::SpellCheckRequest::didSucceed
  blink::WebTextCheckingCompletionImpl::didFinishCheckingText
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=411957:412168
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=413791:414128

Minimized Testcase (1.87 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94C4pqMjZMbzWtlyf98pyWDUz0f4AWQLWhV00A79yFeTIZPemzFQ4YFfLB6pQGPyKahs69o-JMUto7Cisay0QjsFbPkq8Bzyuj_1S9YlVb88WDUDrnYA88OcYiNBZyWf6hkSJ9j_aXtt7X_6rknQrc52Rphwg?testcase_id=6241097116549120

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot