Below are the CL list from finddit:

Author: Blink Reformat
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1c8e1a7719e9d223cc84e838c9a31a0210f5878b
Time: Sat Oct 01 00:25:32 2016
The CL last changed line 712 of file HashTable.h, which is stack frame 0. 

Author: Blink Reformat
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1c8e1a7719e9d223cc84e838c9a31a0210f5878b
Time: Sat Oct 01 00:25:32 2016
The CL last changed line 709 of file HashTable.h, which is stack frame 1. 

Author: Blink Reformat
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1c8e1a7719e9d223cc84e838c9a31a0210f5878b
Time: Sat Oct 01 00:25:32 2016
The CL last changed line 393 of file HashMap.h, which is stack frame 2. 

Author: Blink Reformat
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1c8e1a7719e9d223cc84e838c9a31a0210f5878b
Time: Sat Oct 01 00:25:32 2016
The CL last changed line 887 of file RuleFeature.cpp, which is stack frame 3. 

Author: Blink Reformat
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1c8e1a7719e9d223cc84e838c9a31a0210f5878b
Time: Sat Oct 01 00:25:32 2016
The CL last changed line 120 of file ScopedStyleResolver.cpp, which is stack frame 4. 

Author: Blink Reformat
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/1c8e1a7719e9d223cc84e838c9a31a0210f5878b
Time: Sat Oct 01 00:25:32 2016
The CL last changed line 560 of file StyleEngine.cpp, which is stack frame 5. 

Author: rune
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/17bc158897bb9b9d6b1400ed76092a412de16bc9
Time: Fri Oct 28 10:20:27 2016
The CL last changed line 66 of file CSSGlobalRuleSet.cpp, which is stack frame 6.

==============
This is impacting to head.
From the above CL suspecting the changes made to the file "CSSGlobalRuleSet.cpp" by rune@opera.
Review-Url: https://codereview.chromium.org/2451893003
rune@opera: Could you please take a look into this if its related to your change.

I was not able to reproduce building asan chrome on Linux with the same gn args as the fuzzer report says. I guess this can only be reproduced on Mac?

 Issue 678743  has a similar stack, but for Windows.

 Issue 678743  has been merged into this issue.

 Issue 677979  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/67cfc67e3b62993bb0df9395559e1d1a76d26213

commit 67cfc67e3b62993bb0df9395559e1d1a76d26213
Author: rune <rune@opera.com>
Date: Wed Jan 25 13:09:54 2017

Return ActiveSheetsChanged when rulesets change in common prefix.

When comparing old and new active sheets, we only append the added
sheets to the ScopedStyleResolver if the old sheet vector is a prefix
of the new sheets. However, that's not correct if any of the RuleSets
in the common prefix changed due to media query changes or cssom
modifications of a stylesheet.

I can confirm that this fixes 681472. The other two issues in the BUG
field look like duplicates, but I've not been able to reproduce them.

R=meade@chromium.org,sashab@chromium.org
BUG= 681472 , 677371 , 681882 

Review-Url: https://codereview.chromium.org/2650743002
Cr-Commit-Position: refs/heads/master@{#446008}

[add] https://crrev.com/67cfc67e3b62993bb0df9395559e1d1a76d26213/third_party/WebKit/LayoutTests/fast/css/null-ruleset-non-matching-media-crash.html
[modify] https://crrev.com/67cfc67e3b62993bb0df9395559e1d1a76d26213/third_party/WebKit/Source/core/css/ActiveStyleSheets.cpp
[modify] https://crrev.com/67cfc67e3b62993bb0df9395559e1d1a76d26213/third_party/WebKit/Source/core/css/ActiveStyleSheetsTest.cpp

ClusterFuzz has detected this issue as fixed in range 445996:446011.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4544782853734400

Fuzzer: ifratric-browserfuzzer-v3
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: UNKNOWN READ
Crash Address: 0x0000000000dc
Crash State:
  blink::RuleFeatureSet::add
  blink::ScopedStyleResolver::collectFeaturesTo
  blink::StyleEngine::collectScopedStyleFeaturesTo
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=438143:438157
Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=445996:446011

Minimized Testcase (1.85 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97Iyb_FN22EyhZYdUvpDprOCwd6QmNIw_MPO2mClpjE-SpQrhdDjycuTCB5DIMe2rERpkrBYntLHoy_6xTyiX3un93r457jfPaQHDunyKc50uQuR6oHv8uWsnXSNdPlFHJNlZJnhfekVGcSSNvay0T6Bui9Tb8VHpU3P8QrW-_yqW7KxeqLWIbhmY213LPBtJ6k00S6AqYVl8eJTeYBa1gtTkL9knIDRJM20b61IMBvH26HlXTz9qqMJPSU9BM0Nzo2ZLptsmb8oVVSc946xDToPIbqoIyctbSKJhgDezTCPXS-V2BG0yyjFKZLJMBIwpV6OIOR1r_BRj15halN2XkJGC6zJX0s8abvhTLS_qvqQt_Y6g1UbkV96CvBBq7UAGm35RfgqpM2zHPVLG_YUBWG9XScbw?testcase_id=4544782853734400

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4833c6af7aed66bb1fc500f45f43d6476b890b86

commit 4833c6af7aed66bb1fc500f45f43d6476b890b86
Author: Rune Lillesveen <rune@opera.com>
Date: Thu Jan 26 13:59:56 2017

Return ActiveSheetsChanged when rulesets change in common prefix.

When comparing old and new active sheets, we only append the added
sheets to the ScopedStyleResolver if the old sheet vector is a prefix
of the new sheets. However, that's not correct if any of the RuleSets
in the common prefix changed due to media query changes or cssom
modifications of a stylesheet.

I can confirm that this fixes 681472. The other two issues in the BUG
field look like duplicates, but I've not been able to reproduce them.

R=meade@chromium.org,sashab@chromium.org
BUG= 681472 , 677371 , 681882 

Review-Url: https://codereview.chromium.org/2650743002
Cr-Commit-Position: refs/heads/master@{#446008}
(cherry picked from commit 67cfc67e3b62993bb0df9395559e1d1a76d26213)

Review-Url: https://codereview.chromium.org/2655283002 .
Cr-Commit-Position: refs/branch-heads/2987@{#102}
Cr-Branched-From: ad51088c0e8776e8dcd963dbe752c4035ba6dab6-refs/heads/master@{#444943}

[add] https://crrev.com/4833c6af7aed66bb1fc500f45f43d6476b890b86/third_party/WebKit/LayoutTests/fast/css/null-ruleset-non-matching-media-crash.html
[modify] https://crrev.com/4833c6af7aed66bb1fc500f45f43d6476b890b86/third_party/WebKit/Source/core/css/ActiveStyleSheets.cpp
[modify] https://crrev.com/4833c6af7aed66bb1fc500f45f43d6476b890b86/third_party/WebKit/Source/core/css/ActiveStyleSheetsTest.cpp