Through code search on file render_surface_impl.cc, suspected CL is
https://chromium.googlesource.com/chromium/src/+/bb0b3ae9224e1883dd491b6b6810b6bfe0da8480%5E%21/cc/layers/render_surface_impl.cc

The crash still happens after I revert to the commit before my CL. I have tested the current stable version and canary version, it broke between (58.0.3029.81) dbbd95bace5f6a49951a5af485e009da9f20c763 and (60.0.3076.2) 7d214605ac31d0af2a5fa5438079272ffc098b38.

I manually bisected and found this CL: https://chromium.googlesource.com/chromium/src/+/1553a14bd799b2dd09bebeeeda934379318eaf7e

jaydasika@, can you take a look at this bug?

This is another bad floating point case. The crash is because a render surface(created by fixed pos element) is trying to draw into a target that itself is not drawn. Before my CL, we were lucky that the render surface ended up with empty content rect and was getting dropped before it tried to draw into a non-existent target.

The fix pos element's render surface doesn't get skipped but the target it draws into is skipped because of singular transform. This should actually not happen as the transform between a fix pos's transform node and its target's transform node should be atmost translation. But, I have logged it and its not the case for this page :

[ +0.0000 +0.0000 +0.0000 +29.0000  
  +0.0000 -1.0000 +0.0000 +67108856.0000  
  +0.0000 +0.0000 +1.0000 +0.0000  
  +0.0000 +0.0000 +0.0000 +1.0000 ]
    

 Issue 714431  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 468145:468195.

Detailed report: https://clusterfuzz.com/testcase?key=5227755907317760

Fuzzer: ifratric-browserfuzzer-v3
Job Type: windows_asan_chrome
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0x000000ec
Crash State:
  cc::ListContainerHelper::Allocate
  cc::RenderPass::CreateAndAppendSharedQuadState
  cc::RenderSurfaceImpl::AppendQuads
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=464127:464504
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=468145:468195

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5227755907317760


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5227755907317760 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.