+cc current Mac triage oncall. The ClusterFuzz output for this is really unhelpful.

I loaded the minimized test case and generated http://go/crash/0f20cb4080000000

0x0000000114b571a3	(Google Chrome Framework -HTMLFormElement.cpp:469 )	blink::HTMLFormElement::reset()
0x00000001146470c1	(Google Chrome Framework -V8HTMLFormElement.cpp:435 )	blink::HTMLFormElementV8Internal::resetMethodCallback(v8::FunctionCallbackInfo<v8::Value> const&)
0x000000011027aa2f	(Google Chrome Framework -api-arguments.cc:19 )	v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo<v8::Value> const&))


from the bisect

https://chromium.googlesource.com/chromium/src/+log/bf2cd99bbef2d6e19aa4a7e9e21e4b93f78ae8e3..a536a7769a1652139bd69b6cf58866e5fc9e7fbc?pretty=fuller

suspecting https://codereview.chromium.org/2556043002

Avoid WTF::Vector::at() and operator[] in core/html.

at() and operator[] are slow due to RELEASE_ASSERT. We can avoid the slowness by
range-based |for|.

This CL has no behavior changes except runtime performance.

BUG= 668300 
Committed: https://crrev.com/f5775c2f04c255de2fe9f68ff8444d3f987901a4
Cr-Commit-Position: refs/heads/master@{#437175}

A fix was landed a few hours ago.

ClusterFuzz has detected this issue as fixed in range 438498:440663.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4809597484531712

Fuzzer: ifratric-browserfuzzer-v3
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  NULL
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=437123:437180
Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=438498:440663

Minimized Testcase (0.46 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97Iczr4II4z0BVxMmFlzLCbiyySfx9OXX0k8l72tCuEnGEsY2CnJNze0cYTeHPy0dqN7uwK6-XiQhatP6mPJQYD2V9hd1-yVF9eLGtY17hbtG0VDrZ_sD-lvATGc2Le86ivkQgEecHQEr4x-0lgNiiBANYM1w?testcase_id=4809597484531712
<style>
</style>
<script>

function eventhandler3() {
 if(htmlvar00050) htmlvar00050.appendChild(htmlvar00036); 
 htmlvar00043.reset(); 
}
</script>
<style></style>
<details open="true" ontoggle="eventhandler3()">
<div id="htmlvar00036"8X" scrolling="auto" span="-1" noresize="noresize">
<iframe></iframe>
<textarea></textarea>
</div>
<form id="htmlvar00043">
<button>
<fieldset>
<output>
<br id="htmlvar00050"><style title="%VO1Vv1b`&quot; srcdoc="0q+'=1c" marginheight="9">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot