Assigning to the concern owner from Predator results --
The result is a list of CLs that change the crashed files. 

Author: wangxianzhu
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/0c449aad3898922b599d8a32c2380cc8c962040e
Time: Sat Mar 11 04:09:49 2017
File LayoutBoxModelObject.cpp is changed in this cl (and is part of stack frame #4, "blink::LayoutBoxModelObject::StyleWillChange")
Minimum distance from crash line to modified line: 4. (file: LayoutBoxModelObject.cpp, crashed on: 276, modified: 272).

@wangxianzhu -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f33528d4fd422b1c9eed224255849f66087a5ec2

commit f33528d4fd422b1c9eed224255849f66087a5ec2
Author: Xianzhu Wang <wangxianzhu@chromium.org>
Date: Tue Jun 06 01:30:35 2017

Fix crash when a custom scrollbar changes style

BUG= 727072 

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: Ic89ae38e3ab91c8567022c54de0e071099aaebe8
Reviewed-on: https://chromium-review.googlesource.com/522857
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Reviewed-by: Walter Korman <wkorman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#477146}
[add] https://crrev.com/f33528d4fd422b1c9eed224255849f66087a5ec2/third_party/WebKit/LayoutTests/scrollbars/custom-scrollbar-change-style-crash.html
[modify] https://crrev.com/f33528d4fd422b1c9eed224255849f66087a5ec2/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
[modify] https://crrev.com/f33528d4fd422b1c9eed224255849f66087a5ec2/third_party/WebKit/Source/core/layout/LayoutBoxModelObjectTest.cpp

ClusterFuzz has detected this issue as fixed in range 477133:477146.

Detailed report: https://clusterfuzz.com/testcase?key=4902861283786752

Fuzzer: inferno_layout_test_fuzzer
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IsRooted() in LayoutObject.cpp
  blink::LayoutObject::ContainerForPaintInvalidation
  blink::ObjectPaintInvalidator::InvalidatePaintIncludingNonCompositingDescendants
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=456256:456287
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=477133:477146

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4902861283786752


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4902861283786752 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Your change meets the bar and is auto-approved for M60. Please go ahead and merge the CL to branch 3112 manually. Please contact milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), josafat@(ChromeOS), bustamante@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/57ced644b194ae6cae720399f445398784e10e3f

commit 57ced644b194ae6cae720399f445398784e10e3f
Author: Xianzhu Wang <wangxianzhu@chromium.org>
Date: Wed Jun 07 16:54:52 2017

Fix crash when a custom scrollbar changes style

BUG= 727072 
TBR=wangxianzhu@chromium.org

(cherry picked from commit f33528d4fd422b1c9eed224255849f66087a5ec2)

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: Ic89ae38e3ab91c8567022c54de0e071099aaebe8
Reviewed-on: https://chromium-review.googlesource.com/522857
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Reviewed-by: Walter Korman <wkorman@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#477146}
Reviewed-on: https://chromium-review.googlesource.com/527234
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/branch-heads/3112@{#224}
Cr-Branched-From: b6460e24cf59f429d69de255538d0fc7a425ccf9-refs/heads/master@{#474897}
[add] https://crrev.com/57ced644b194ae6cae720399f445398784e10e3f/third_party/WebKit/LayoutTests/scrollbars/custom-scrollbar-change-style-crash.html
[modify] https://crrev.com/57ced644b194ae6cae720399f445398784e10e3f/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
[modify] https://crrev.com/57ced644b194ae6cae720399f445398784e10e3f/third_party/WebKit/Source/core/layout/LayoutBoxModelObjectTest.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b00a8499e4aa3e9706bcb85a8fc4c9f93d4b7d6d

commit b00a8499e4aa3e9706bcb85a8fc4c9f93d4b7d6d
Author: Xianzhu Wang <wangxianzhu@chromium.org>
Date: Wed Jun 07 19:56:10 2017

Remove test added by https://chromium-review.googlesource.com/527234

The test doesn't compile on beta channel.

BUG= 727072 
TBR=wangxianzhu@chromium.org

Change-Id: I1f5e7cbfd33f3c0b2237e518d774ac7702bab0e9
Reviewed-on: https://chromium-review.googlesource.com/527695
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/branch-heads/3112@{#229}
Cr-Branched-From: b6460e24cf59f429d69de255538d0fc7a425ccf9-refs/heads/master@{#474897}
[modify] https://crrev.com/b00a8499e4aa3e9706bcb85a8fc4c9f93d4b7d6d/third_party/WebKit/Source/core/layout/LayoutBoxModelObjectTest.cpp