Predator did not generate any suspected culprits:

From the regression range below:

https://chromium.googlesource.com/chromium/src/+log/d606a2ca65f6c478ea7970ce3e6adc20aa34b486..4dc3da85cabab5ebae5807dbb4ecb3d270e9072b?pretty=fuller

Suspecting the below change could be a possible culprit:

https://chromium.googlesource.com/chromium/src/+/b450b96f42a6a7328ee0cdcdf78ad4ea95dca8da

@ staraz: Assigning to you. Kindly take a look into it. Please help us to find an owner if not with respect to your change.

Thanks.!

I don't think my change has anything to do with it. My change moved a parameter
from one settings class to another and it did not change any logic inside the 
DecoderCache.

ericrk@: Could you take a look? I found your ldap on git blame at 
GpuImageDecodeCache::UnrefImageInternal. Thanks!

It appears that something is causing an outstanding image ref to outlive LayerTreeHostImpl::CleanUpTileManagerAndUIResources (and image decode cache destruction)...

Looking at the revision range, it seems like the finch config for checker-images was turned on in this range. I wonder if part of the checker image code is allowing outstanding image refs to outlive image decode cache lifetime (which would be a problem).

Khushal, does this sound possible to you? Would you mind taking a look?

ClusterFuzz has detected this issue as fixed in range 479114:479249.

Detailed report: https://clusterfuzz.com/testcase?key=5039750011682816

Fuzzer: attekett_surku_fuzzer
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: CHECK failure
Crash Address: 
Crash State:
  0u == in_use_cache_.size() in gpu_image_decode_cache.cc
  cc::GpuImageDecodeCache::~GpuImageDecodeCache
  cc::GpuImageDecodeCache::~GpuImageDecodeCache
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=476032:476089
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=479114:479249

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5039750011682816


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 479114:479249.

Detailed report: https://clusterfuzz.com/testcase?key=5039750011682816

Fuzzer: attekett_surku_fuzzer
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: CHECK failure
Crash Address: 
Crash State:
  0u == in_use_cache_.size() in gpu_image_decode_cache.cc
  cc::GpuImageDecodeCache::~GpuImageDecodeCache
  cc::GpuImageDecodeCache::~GpuImageDecodeCache
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=476032:476089
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=479114:479249

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5039750011682816


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 479114:479249.

Detailed report: https://clusterfuzz.com/testcase?key=5039750011682816

Fuzzer: attekett_surku_fuzzer
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: CHECK failure
Crash Address: 
Crash State:
  0u == in_use_cache_.size() in gpu_image_decode_cache.cc
  cc::GpuImageDecodeCache::~GpuImageDecodeCache
  cc::GpuImageDecodeCache::~GpuImageDecodeCache
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=476032:476089
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=479114:479249

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5039750011682816


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.