This one's a reproducer using WebGL and our validation of drawElements calls should definitely be catching it.

ClusterFuzz has detected this issue as fixed in range 485134:485139.

Detailed report: https://clusterfuzz.com/testcase?key=5590844437692416

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  gleRunVertexSubmitImmediate
  glDrawArrays_GL3Exec
  gpu::gles2::GLES2DecoderImpl::DoDrawArrays
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=338204:338244
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=485134:485139

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5590844437692416


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5590844437692416 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Ah, this turned out to be a duplicate of a bug which piman just fixed in I0ca7d9b8a962d7de13016f5c04d5ab1d7348f514 . Duplicating this into  Issue 736639  for which that seemed to be the main fix. Thanks piman for tracking that down and fixing it.