Using Find it, assigning to the concern owner, below are the results --
The result is a list of CLs that change the crashed files. 

Author: mkwst
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/46b2f19290555de613e09226348ae711db179f58
Time: Thu Nov 24 21:48:42 2016
Lines 687-693 of file HTMLDocumentParser.cpp which potentially caused crash are changed in this cl (frame #1, "blink::HTMLDocumentParser::pumpTokenizer").
Minimum distance from crash line to modified line: 0. (file: HTMLDocumentParser.cpp, crashed on: 687, modified: 687).

@mkwst -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

I can't replicate this locally, even under ASAN. That said, I guess I can understand how `frameLoader.client()` could be `nullptr` depending on when `onload` fires (thus triggering more navigations). I'll add a check.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1d7a2e8d1b446d3ec4b55932d623e1ffe933fd47

commit 1d7a2e8d1b446d3ec4b55932d623e1ffe933fd47
Author: mkwst <mkwst@chromium.org>
Date: Tue Nov 29 07:45:52 2016

Fix a potential null deref in XSSAuditorDelegate.

The ASAN bots say this causes a crash; I can't replicate it locally, but
I believe that the combination of `document.write` and synchronous
`javascript:` URL navigation could cause the auditor to trigger while the
document is detaching. This patch adds a small check.

BUG= 668772 

Review-Url: https://codereview.chromium.org/2531253002
Cr-Commit-Position: refs/heads/master@{#434927}

[modify] https://crrev.com/1d7a2e8d1b446d3ec4b55932d623e1ffe933fd47/third_party/WebKit/Source/core/html/parser/XSSAuditorDelegate.cpp

ClusterFuzz testcase 5709330168152064 is flaky and no longer reproduces, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.