Predator and regression range did not find any suspect CL. cc-ing few devs who worked on CSP. could someone please take a look?.
Thank you

Using Code Search for the file, "SourceLocation.cpp" assigning to the concern owner from GitBlame.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/9d858647530db2c22e1267e443034d23f2e602d9%5E%21/third_party/WebKit/Source/bindings/core/v8/SourceLocation.cpp

@lukasza -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

jbroman@ / mmoroz@ - I think this leak is an artifact of how the fuzzer runs.  I am guessing that SourceLocation + ConsoleMessage are kept alive by |g_page_holder| from third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyFuzzer.cpp.  Could you PTAL?

lukasza@, actually this seems fine to me, as LSAN doesn't report leaks in cases like that. The comment at https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyFuzzer.cpp?l=14 also confirms that it is intended.

To be totally sure, I tried it with the following patch:

--- a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyFuzzer.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyFuzzer.cpp
@@ -17,11 +17,12 @@ DummyPageHolder* g_page_holder = nullptr;
 
 int LLVMFuzzerInitialize(int* argc, char*** argv) {
   InitializeBlinkFuzzTest(argc, argv);
-  g_page_holder = DummyPageHolder::Create().release();
+//  g_page_holder = DummyPageHolder::Create().release();
   return 0;
 }
 
 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    g_page_holder = DummyPageHolder::Create().release();
   String header = String::FromUTF8(data, size);
   unsigned hash = header.IsNull() ? 0 : header.Impl()->GetHash();
 
@@ -41,6 +42,8 @@ int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
                                                 BlinkGC::kGCWithSweep,
                                                 BlinkGC::kForcedGC);
 
+  delete g_page_holder;
+
   return 0;
 }


And behavior didn't change.

Also, the issue has been marked as non reproducible ~2 weeks ago, so I think it would be fine to close it as unintended fix (probably):

[2017-04-13 08:39:24 UTC] clusterfuzz-linux-0266: Progression task errored out: Known crash revision 463938 did not crash.
[2017-04-13 08:39:25 UTC] clusterfuzz-linux-0266: Progression task errored out: Test case appears to be flaky.