Predator did not provide any possible suspects.
Assigning to concern owner from CL--
https://chromium.googlesource.com/chromium/src/+log/562876f283093f8facece42cafa3defde3d5e000..9261f26075fab250385db2abde6c63deec1961ed?pretty=fuller

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/9261f26075fab250385db2abde6c63deec1961ed

@robhogan -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/15f72ae61fa15ea75e3b5075d23c63027665b1a1

commit 15f72ae61fa15ea75e3b5075d23c63027665b1a1
Author: Robert Hogan <robhogan@gmail.com>
Date: Tue Aug 01 07:38:45 2017

Ensure table is not a spanner before attempting to repeat table header

PageLogicalHeightForOffset() requires that IsPageLogicalHeightKnown().

Bug:  747788 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I2caad3956dd6c2797788af8b366df0f3223ed4e7
Reviewed-on: https://chromium-review.googlesource.com/593008
Reviewed-by: Morten Stenshorne <mstensho@opera.com>
Commit-Queue: Robert Hogan <robhogan@gmail.com>
Cr-Commit-Position: refs/heads/master@{#490899}
[add] https://crrev.com/15f72ae61fa15ea75e3b5075d23c63027665b1a1/third_party/WebKit/LayoutTests/fast/multicol/span/thead-in-spanner-crash.html
[modify] https://crrev.com/15f72ae61fa15ea75e3b5075d23c63027665b1a1/third_party/WebKit/Source/core/paint/TableSectionPainter.cpp

ClusterFuzz has detected this issue as fixed in range 490859:490925.

Detailed report: https://clusterfuzz.com/testcase?key=5089208934072320

Fuzzer: bj_broddelwerk
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Floating-point-exception
Crash Address: 
Crash State:
  blink::TableSectionPainter::PaintRepeatingHeaderGroup
  blink::TableSectionPainter::Paint
  blink::LayoutTableSection::Paint
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=476203:476212
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=490859:490925

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5089208934072320


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5089208934072320 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.