Through code search on file  PaintController.cpp, suspected CL is
https://chromium.googlesource.com/chromium/src/+/5d28b2b610719d4d1c4d1fd7f8a74e8dfeba0d33%5E%21/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp

wangxianzhu@, could you please take a look and please help us to find correct owner if it is not related your changes.

The test uses internals.addTextMatchMarker() which doesn't invalidate the scrollbar intentionally. The realworld caller of DocumentMarkerController::addTextMatchMarker() (TextFinder) will invalidate the scrollbar with a throttling algorithm.

ClusterFuzz has detected this issue as fixed in range 421165:421183.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4514637649543168

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_ubsan_vptr_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false. Can't find cached display item in PaintController.cpp
  blink::PaintController::findOutOfOrderCachedItemForward
  blink::PaintController::useCachedDrawingIfPossible
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=416781:416826
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=421165:421183

Minimized Testcase (1.19 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97WtQk5UxCcpHsC4sgOGGuaZv9QHhcBHhz3TgfzZ_a6DFPZNT9gG9s3VK0LFGYciJJ2b7c6OZbIq0iHoIj-TntzLQH4rnHZGjOYBr5pPH4h3Mjds7g_Sp2AGmxn3OJZ4YUn9puptfYC1Wr9UDNQddeBx8TW8Q?testcase_id=4514637649543168

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

 Issue 655005  has been merged into this issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot