Assigning to the concern owner from Predator results --
The result is a list of CLs that change the crashed files. 

Author: sunyunjia
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/cb18694aff180e913277a346a37e74835935b37d
Time: Tue Aug 23 01:11:30 2016
Lines 340-361 of file SliderThumbElement.cpp which potentially caused crash are changed in this cl (frame #0, "blink::SliderContainerElement::HandleTouchEvent"; frame #1, "blink::SliderContainerElement::DefaultEventHandler").
Minimum distance from crash line to modified line: 0. (file: SliderThumbElement.cpp, crashed on: 337, modified: 337).

@sunyunjia -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.

A testcase removes "type" attribute in "input" event handler.

sunyunjia@, any progress on this issue?

Thanks for reminding! I'm working on it.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2f5c9207b8832b4d8fbd1bbb51eae50ebc8090ac

commit 2f5c9207b8832b4d8fbd1bbb51eae50ebc8090ac
Author: Sandra Sun <sunyunjia@chromium.org>
Date: Mon Jan 22 19:24:41 2018

Check nullptrs in SliderContainerElement::HandleTouchEvent()

If the slider is removed during a smooth drag, it may result in a
nullptr. Thus we check the nullptrs in HandleTouchEvent().

Bug:  727248 
Change-Id: Ib22785a57a3a05c63231551672219bb46321d91d
Reviewed-on: https://chromium-review.googlesource.com/877788
Reviewed-by: David Bokan <bokan@chromium.org>
Commit-Queue: Sandra Sun <sunyunjia@chromium.org>
Cr-Commit-Position: refs/heads/master@{#530944}
[add] https://crrev.com/2f5c9207b8832b4d8fbd1bbb51eae50ebc8090ac/third_party/WebKit/LayoutTests/fast/events/drag-on-removed-slider-does-not-crash.html
[modify] https://crrev.com/2f5c9207b8832b4d8fbd1bbb51eae50ebc8090ac/third_party/WebKit/Source/core/html/forms/SliderThumbElement.cpp

ClusterFuzz has detected this issue as fixed in range 530939:530944.

Detailed report: https://clusterfuzz.com/testcase?key=6671257025380352

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::SliderContainerElement::HandleTouchEvent
  blink::SliderContainerElement::DefaultEventHandler
  blink::EventDispatcher::DispatchEventPostProcess
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=413548:413636
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=530939:530944

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6671257025380352

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6671257025380352 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.