The result is a list of CLs that change the crashed files.

Author: yosin
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/d4e4efc136c41f9182c0143eec4e15f4bc47ac95
Time: Mon Jun 05 09:15:05 2017
The CL last changed line 736 of file VisibleUnitsLine.cpp, which is stack frame 3.

@ yosin: Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Route to Blink>Layout, because null-reference is RootInlineBox::ClosestLeafChildForLogicalLeftPosition() called from Selection#modify().


It seems RootInlineBox::FirstLeafChild() or FirstLeafChild()->NextLeafChildIgnoringLineBreak() can be nullptr for non-null RootInlineBox.

ClusterFuzz has detected this issue as fixed in range 501676:501727.

Detailed report: https://clusterfuzz.com/testcase?key=5052320902807552

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x00000000003d
Crash State:
  blink::RootInlineBox::ClosestLeafChildForLogicalLeftPosition
  blink::NextLinePosition
  blink::SelectionModifier::ModifyMovingForward
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=434178:434216
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=501676:501727

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5052320902807552

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5052320902807552 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.