Through code search on file PaintLayerScrollableArea.cpp, suspected CL is 
https://chromium.googlesource.com/chromium/src/+/f903348fa83ee0e48eb45a1b850bcd16ab230392
szager@, could you please take a look?

Looks like this is due to a null reference returned by PaintLayerScrollableArea::scrollbarStyleSource().

skobes@, you touched that code recently; can you take a look?

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d23ef9b37d71d31b82613f8ddb8da614cd54c665

commit d23ef9b37d71d31b82613f8ddb8da614cd54c665
Author: skobes <skobes@chromium.org>
Date: Tue Mar 07 18:31:17 2017

Fix null pointer dereference in PLSA's scrollbarStyleSource.

The scroller inside the alt-text shadow tree created by HTMLImageFallbackHelper
was trying to read scrollbar styles from the <img> element, which had no
LayoutObject because it was styled with "display: contents".

BUG= 697247 
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2734993002
Cr-Commit-Position: refs/heads/master@{#455148}

[add] https://crrev.com/d23ef9b37d71d31b82613f8ddb8da614cd54c665/third_party/WebKit/LayoutTests/fast/dom/shadow/img-display-contents-crash-expected.txt
[add] https://crrev.com/d23ef9b37d71d31b82613f8ddb8da614cd54c665/third_party/WebKit/LayoutTests/fast/dom/shadow/img-display-contents-crash.html
[modify] https://crrev.com/d23ef9b37d71d31b82613f8ddb8da614cd54c665/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp

This likely regressed in r451966, so we need a merge into M58.

Your change meets the bar and is auto-approved for M58. Please go ahead and merge the CL to branch 3029 manually. Please contact milestone owner if you have questions.
Owners: amineer@(clank), cmasso@(bling), bhthompson@(cros), govind@(desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

We are planning to cut Dev RC today (03/08) at 5.00 PM PST. Please merge the CL to M58 branch (3029) ASAP.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bff179ffca3cc9e47629a280d8ffd40970bb2b38

commit bff179ffca3cc9e47629a280d8ffd40970bb2b38
Author: Steve Kobes <skobes@chromium.org>
Date: Wed Mar 08 22:27:55 2017

Fix null pointer dereference in PLSA's scrollbarStyleSource.

The scroller inside the alt-text shadow tree created by HTMLImageFallbackHelper
was trying to read scrollbar styles from the <img> element, which had no
LayoutObject because it was styled with "display: contents".

BUG= 697247 
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2734993002
Cr-Commit-Position: refs/heads/master@{#455148}
(cherry picked from commit d23ef9b37d71d31b82613f8ddb8da614cd54c665)

Review-Url: https://codereview.chromium.org/2736873006 .
Cr-Commit-Position: refs/branch-heads/3029@{#71}
Cr-Branched-From: 939b32ee5ba05c396eef3fd992822fcca9a2e262-refs/heads/master@{#454471}

[add] https://crrev.com/bff179ffca3cc9e47629a280d8ffd40970bb2b38/third_party/WebKit/LayoutTests/fast/dom/shadow/img-display-contents-crash-expected.txt
[add] https://crrev.com/bff179ffca3cc9e47629a280d8ffd40970bb2b38/third_party/WebKit/LayoutTests/fast/dom/shadow/img-display-contents-crash.html
[modify] https://crrev.com/bff179ffca3cc9e47629a280d8ffd40970bb2b38/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp

ClusterFuzz has detected this issue as fixed in range 455091:455394.

Detailed report: https://clusterfuzz.com/testcase?key=4697830553026560

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000042
Crash State:
  blink::PaintLayerScrollableArea::needsScrollbarReconstruction
  blink::PaintLayerScrollableArea::updateAfterLayout
  blink::LayoutBlockFlow::layoutBlock
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=451929:451968
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=455091:455394

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv95X6TnWML7y9zlrwmPaolIxDnO6StsOKkTnGhwgHJsj9rYLwGA7oyeqRDts0XXZ5uk95-rC2xBLSq4mRWVSWSFEqKsSZx-eeH4nInahL1zJ9ZQsvqJXEJeeO9rSQqmZFF1pVM7on7rlSwwuD61D2kSb5FlXb-HI4W7MP5lpr9-9DSnNWznsUNsUsFMam-_bpRYU96Q4V-hpbsrlpCNPPeh6wCzLvLKN5PC8CTF7v-9HVmjl1RXZPU3GNefCU7cMxqFiKpZxANbYd34ZZQ62bCbtXNWJDA2K97c1c61iBXLaKTLUifyKhnuyLnUm7cJbL1iihK4y2ox15s_S_YgGYtdqKqX4QS04WuPzpCKvBpiFX-muJ1U?testcase_id=4697830553026560


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.