Find it and CL did not provide any possible suspects.
Using Code Search for the file, "backgroundimagegeometry.cpp" assigning to the concern owner.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/949b36db0565e9a81fc50cbb1584d64d6090c147

@robhogan -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f0f5a49bb64045baf41a50c470540a0e86ddcf67

commit f0f5a49bb64045baf41a50c470540a0e86ddcf67
Author: robhogan <robhogan@gmail.com>
Date: Mon Jan 23 20:41:55 2017

Don't assume every cell in a row has a column

BUG= 683594 
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2649953003
Cr-Commit-Position: refs/heads/master@{#445474}

[add] https://crrev.com/f0f5a49bb64045baf41a50c470540a0e86ddcf67/third_party/WebKit/LayoutTests/fast/table/backgr_image-crash-expected.txt
[add] https://crrev.com/f0f5a49bb64045baf41a50c470540a0e86ddcf67/third_party/WebKit/LayoutTests/fast/table/backgr_image-crash.html
[modify] https://crrev.com/f0f5a49bb64045baf41a50c470540a0e86ddcf67/third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp

ClusterFuzz has detected this issue as fixed in range 445316:445321.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4994637673791488

Fuzzer: ifratric-browserfuzzer-v3
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000017
Crash State:
  blink::LayoutTableCol::enclosingColumnGroup
  blink::BackgroundImageGeometry::getBackgroundObjectDimensions
  blink::BackgroundImageGeometry::calculate
  
Memory Tool: SYZYASAN

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=445287:445288
Fixed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_chrome&range=445316:445321

Minimized Testcase (1.29 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95ODSrIXf0y1-GSjmfvMiFcutwUEEGTpsxjat0DOx0W4lBjQgvl2iY_wnM6gSN_XpfYoOXU80jaN_7cD1Wqs4Ag7k5qoUB7sEmi-uizmyYxQz70obkrL76lVClUxoTgDxxuYC8CcdGqyqTU6TSMCjtj2CZqpNsn_bM3PJWNQATm0JnbjpnPasXSZbaDq6joCwjZWgY6Iigmwd55XV06VmAGKzzgsKtArl1Gi8gJXe-dhsLTmCJM-i1Ts9-WpMyyAGBcXj1Q6PxmgfJmpapLEZLIsTaQ_lyPh5HR-76H4Jpzv7TZhuRvKusk4iPfWuXezjc0s9G_y_XkFnwsvvZjJbptmpsqtgEGcKEbHniGsEUjQGA86SU?testcase_id=4994637673791488

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4994637673791488 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.