Assigning to the concern owner from Predator results --
The result is a list of CLs that change the crashed files. 

Author: rockot
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/a628d0b45d5ce49a035020d8d67e9cc9a562ecac
Time: Thu Feb 09 08:40:15 2017
Lines 288 of file ipc_channel_mojo.cc which potentially caused crash are changed in this cl (frame #1, "IPC::ChannelMojo::ForwardMessageFromThreadSafePtr").
Minimum distance from crash line to modified line: 0. (file: ipc_channel_mojo.cc, crashed on: 288, modified: 288).

@rockot -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/67b4b0c5317c2a8e30e141540697200094b9bff3

commit 67b4b0c5317c2a8e30e141540697200094b9bff3
Author: rockot <rockot@chromium.org>
Date: Thu Feb 09 21:25:20 2017

Fix nullptr dereference in thread-safe Channel forwarding

It's possible to hit IPc::ChannelMojo::ForwardMessage* while
the MessagePipeReader is still alive but has closed its sender
binding. This fixes that.

BUG= 690493 
TEST=content_browsertests with ASAN

Review-Url: https://codereview.chromium.org/2682223005
Cr-Commit-Position: refs/heads/master@{#449413}

[modify] https://crrev.com/67b4b0c5317c2a8e30e141540697200094b9bff3/ipc/ipc_channel_mojo.cc

 Issue 690590  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 449378:450347.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5038258737381376

Fuzzer: meacer_extension_apis
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  IPC::ChannelMojo::ForwardMessageFromThreadSafePtr
  base::internal::Invoker<base::internal::BindState<void
  base::internal::Invoker<base::internal::BindState<base::Callback<void
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=449231:449250
Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=449378:450347

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95eLlUqu0mGv6ednHyJuq8jrU154J36CxQ8UaaY1Br7tk7atnh1-tJCIiI4C9DRNW_sjHf-Ld6O9kqoAMnlhFoDap32WE-pfZ7vQ93BXvcNQdsnl7GJxrwf-v3KJxQ_uZ3ztCxGdQrU6kyI09n6qkYE-I0YrTSGDtunEIxxgWd6AOjLbOvHLFvaZRzEKwcpUo1bNWORTZJuvdKICzbIoLzuc7JECSnzHFGnWwVlvNuQWxzzd517uS-ebQKXHRgGQNdb2bbk4FhGDJ4U8Exz6xPC9GCzTlCqtwuvDFQCuZBlaclyWPUmb36QeEkymH0rYU-CA0AO22rXGFuRxPzIFHlqFyvExaHZfiHZ7rxO7ptrlV1aPeiDMUXRGgZwZ2SzxbZ9vylVes4EOxVIBjNQB2lzfn51Eg?testcase_id=5038258737381376


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.