The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0e922f67a9bcd8faae007264c08f58fa7d9dcae4

commit 0e922f67a9bcd8faae007264c08f58fa7d9dcae4
Author: Kent Tamura <tkent@chromium.org>
Date: Wed Jun 28 10:58:22 2017

Fix a null pointer dereference in HTMLSelectElement::ScrollToOptionAfterLayout().

option_box->Container() can be nullptr, and we should not call
OffsetFromContainer() in such case.

This CL moves the first call of OffsetFromContainer() into the |for| loop to
check nullness of |container|.

Bug:  737447 
Change-Id: I4120dbfe764fc763556f508fde339ba89c131942
Reviewed-on: https://chromium-review.googlesource.com/551456
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#482941}
[modify] https://crrev.com/0e922f67a9bcd8faae007264c08f58fa7d9dcae4/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
[modify] https://crrev.com/0e922f67a9bcd8faae007264c08f58fa7d9dcae4/third_party/WebKit/Source/core/html/HTMLSelectElementTest.cpp

ClusterFuzz has detected this issue as fixed in range 482916:482992.

Detailed report: https://clusterfuzz.com/testcase?key=4765944965758976

Fuzzer: bj_broddelwerk
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x00000022
Crash State:
  blink::LayoutBox::OffsetFromContainer
  blink::HTMLSelectElement::ScrollToOptionAfterLayout
  blink::PaintLayerScrollableArea::UpdateAfterLayout
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_v8_arm&range=482782:482837
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_v8_arm&range=482916:482992

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4765944965758976


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4765944965758976 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.