wangxianzhu @ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b6f6dab6bacc9029e75e21df0b4be04783e675c6

commit b6f6dab6bacc9029e75e21df0b4be04783e675c6
Author: wangxianzhu <wangxianzhu@chromium.org>
Date: Thu Sep 15 01:47:17 2016

Fix under-invalidation of media slider thumb when network state changes

When we invalidate a media control, we need to invalidate the whole
subtree because not only the top-level layout object but also the
descendants may paint differently.

BUG= 645225 
TEST=paint/invalidation/video-play-no-source-under-invalidation.html

Review-Url: https://codereview.chromium.org/2343713003
Cr-Commit-Position: refs/heads/master@{#418750}

[delete] https://crrev.com/acc8ce6ac31a3de314a10e8fc590910624b31783/third_party/WebKit/LayoutTests/media/media-audio-no-spurious-repaints-expected.txt
[rename] https://crrev.com/b6f6dab6bacc9029e75e21df0b4be04783e675c6/third_party/WebKit/LayoutTests/paint/invalidation/media-audio-no-spurious-repaints.html
[modify] https://crrev.com/b6f6dab6bacc9029e75e21df0b4be04783e675c6/third_party/WebKit/LayoutTests/paint/invalidation/video-mute-repaint-expected.txt
[add] https://crrev.com/b6f6dab6bacc9029e75e21df0b4be04783e675c6/third_party/WebKit/LayoutTests/paint/invalidation/video-play-no-source-under-invalidation-expected.txt
[add] https://crrev.com/b6f6dab6bacc9029e75e21df0b4be04783e675c6/third_party/WebKit/LayoutTests/paint/invalidation/video-play-no-source-under-invalidation.html
[modify] https://crrev.com/b6f6dab6bacc9029e75e21df0b4be04783e675c6/third_party/WebKit/LayoutTests/paint/invalidation/video-unmute-repaint-expected.txt
[delete] https://crrev.com/acc8ce6ac31a3de314a10e8fc590910624b31783/third_party/WebKit/LayoutTests/platform/android/paint/invalidation/video-mute-repaint-expected.txt
[delete] https://crrev.com/acc8ce6ac31a3de314a10e8fc590910624b31783/third_party/WebKit/LayoutTests/platform/android/paint/invalidation/video-unmute-repaint-expected.txt
[modify] https://crrev.com/b6f6dab6bacc9029e75e21df0b4be04783e675c6/third_party/WebKit/Source/core/html/shadow/MediaControls.cpp

ClusterFuzz has detected this issue as fixed in range 418732:418781.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6698537134063616

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false in PaintController.cpp
  blink::PaintController::checkUnderInvalidation
  blink::PaintController::processNewItem
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=416628:416826
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=418732:418781

Minimized Testcase (0.20 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97iT5l-lZcqRsWPC7gqoetgsTr41g2FRsfWhdxGqwKqY_kY9iYgw9lOjNltO4LIug53Q-wmdXDzNipwTaLvQ7lhJbavlwwl6lCsmHXrjc-YYZlbYE28wRSvZX0CcP3CNtXjJc1KGm9BFkkNNr_Sjy8pNBi6JA?testcase_id=6698537134063616
<video controls="">
   <source src="opera/track/webvtt/rendering/reftest/media/white.webm">
<script charset="utf-8">

    internals.runtimeFlags.paintUnderInvalidationCheckingEnabled = true;
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot