Predator did not provide any possible suspects.
Assigning to concern owner from CL --
https://chromium.googlesource.com/chromium/src/+log/8f7a5ea7d66888d0c1d5b73e2a56e9b9de714e5e..f1fa8090bad79ebf7651055eac8bc9dca2151465?pretty=fuller

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/53f28fc2b36f629889e029097c5e042df4a1acd8

@hongchan -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d29c48172aa601e088d9bdbf862f7aee3493da87

commit d29c48172aa601e088d9bdbf862f7aee3493da87
Author: Hongchan Choi <hongchan@chromium.org>
Date: Wed Jul 26 21:39:50 2017

Use GetRenderingThread() in OfflineAudioDestinationNode

There was a mistake in |DoOfflineRendering()| that the code tries to
access |render_thread_| directly. After the experimental threading for
AudioWorklet[1], the rendering thread must be accessed via
|GetRenderingThread()| method.

[1]: https://chromium-review.googlesource.com/c/585358/

Bug:  749058 
Change-Id: I11b68ad0dd97feafec1bf1f8c1617552760457db
Reviewed-on: https://chromium-review.googlesource.com/587151
Reviewed-by: Raymond Toy <rtoy@chromium.org>
Commit-Queue: Hongchan Choi <hongchan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#489761}
[modify] https://crrev.com/d29c48172aa601e088d9bdbf862f7aee3493da87/third_party/WebKit/Source/modules/webaudio/OfflineAudioDestinationNode.cpp

Marking this as fixed. Waiting for CF to verify the fix.

ClusterFuzz has detected this issue as fixed in range 489756:489861.

Detailed report: https://clusterfuzz.com/testcase?key=5524943768125440

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: Null-dereference
Crash Address: 0x00000003
Crash State:
  blink::OfflineAudioDestinationHandler::DoOfflineRendering
  blink::RunCrossThreadClosure
  base::internal::Invoker<base::internal::BindState<void
  
Memory Tool: SYZYASAN

Regressed: https://clusterfuzz.com/revisions?job=windows_syzyasan_content_shell&range=489449:489540
Fixed: https://clusterfuzz.com/revisions?job=windows_syzyasan_content_shell&range=489756:489861

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5524943768125440


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5524943768125440 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.