Predator and CL did not provide any possible suspects.
Using Code Search for the file, "SpatialNavigation.cpp" assigning to concern owner.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/1c38965c165d21706028861200fab06b1eca0bea

@skobes -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

r473695 seems unrelated.  The only function it touches in SpatialNavigation.cpp is CanScrollInDirection, which doesn't appear anywhere in the stack for this report.

Hugo, could you take a look?

I don't reproduce it manually with https://clusterfuzz.com/download?testcase_id=5241737483386880 on ToT. Probably because the "fuzzing" starts after a random delay? Here it is setTimeout(fuzz, 393).

ScrollableEnclosingBoxOrParentFrameForNodeInDirection() can crash if it is given a null-pointer. It is called at 3 locations:

1. FocusController.cpp:1423 - OK
|focused_element| is null-checked.

2. FocusController.cpp:1430 - NOT OK
|area.ImageElement()| is not null-checked.

3. FocusController.cpp:1442 - OK 
|container| == |focused_document| so it is null-checked at line 1410.

Looking at the crashing test, fuzz-744-snav-imagemap-overlapped-areas.html I see that domfuzz_removeAttribute() removes the usemap attribute! That makes the HTMLAreaElement loose its connected <img> and |area.ImageElement()| becomes null.

Fix: https://chromium-review.googlesource.com/c/586589

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3133a8cf09d537e115640a7cc4675b2c091d27ff

commit 3133a8cf09d537e115640a7cc4675b2c091d27ff
Author: Hugo Holgersson <hugoh@opera.com>
Date: Thu Jul 27 22:57:27 2017

Fix crash in spatnav when <area> looses its connected <img>

BUG= 747734 
TEST=See above clusterfuzz bug for repro steps.

Change-Id: I9d2ee28c7dab9e5f9af875e3011b1d0acb13ae29
Reviewed-on: https://chromium-review.googlesource.com/586589
Reviewed-by: Takayoshi Kochi <kochi@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Commit-Queue: Hugo Holgersson <hugoh@opera.com>
Cr-Commit-Position: refs/heads/master@{#490049}
[modify] https://crrev.com/3133a8cf09d537e115640a7cc4675b2c091d27ff/third_party/WebKit/Source/core/page/FocusController.cpp

ClusterFuzz has detected this issue as fixed in range 490023:490066.

Detailed report: https://clusterfuzz.com/testcase?key=5241737483386880

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000020
Crash State:
  blink::ScrollableEnclosingBoxOrParentFrameForNodeInDirection
  blink::FocusController::AdvanceFocusDirectionally
  blink::FocusController::AdvanceFocus
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=473072:473106
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=490023:490066

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5241737483386880


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5241737483386880 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.