Predator and CL did not provide any possible suspects.
Using Code Search for the file, "frameloaderstatemachine.cpp" assigning to the concern owner who might be related.

@nbarth -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

I have not been working on Chromium for years, and don't recognize this code regardless.
Please find an active contributor to investigate.

ClusterFuzz has detected this issue as fixed in range 488838:488849.

Detailed report: https://clusterfuzz.com/testcase?key=4850381606879232

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_syzyasan_chrome
Platform Id: windows

Crash Type: Null-dereference
Crash Address: 0x0000005f
Crash State:
  blink::FrameLoaderStateMachine::IsDisplayingInitialEmptyDocument
  blink::DocumentLoader::InstallNewDocument
  blink::DocumentLoader::ReplaceDocumentWhileExecutingJavaScriptURL
  
Memory Tool: SYZYASAN

Regressed: https://clusterfuzz.com/revisions?job=windows_syzyasan_chrome&range=483638:483645
Fixed: https://clusterfuzz.com/revisions?job=windows_syzyasan_chrome&range=488838:488849

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4850381606879232


Additional requirements: Requires Gestures

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4850381606879232 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.