"""
#0 0x7fff99cbb59f in _platform_memmove$VARIANT$Nehalem
#1 0x1014cb55f in __asan_memcpy
#2 0x10c9db352 in cc::draw_property_utils::(anonymous namespace)::ComputeClips(cc::PropertyTrees*) cc/trees/draw_property_utils.cc:763:9
#3 0x10c9ef9f1 in cc::LayerTreeHost::DoUpdateLayers(cc::Layer*) cc/trees/layer_tree_host.cc:734:5
#4 0x10c9eed42 in cc::LayerTreeHost::UpdateLayers() cc/trees/layer_tree_host.cc:618:17
#5 0x10cac654e in cc::ProxyMain::BeginMainFrame(std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> >) cc/trees/proxy_main.cc:222:60
#6 0x10cac310c in Invoke<base::WeakPtr<cc::ProxyMain>, std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> > > base/bind_internal.h:196:12
#7 0x10cac310c in MakeItSo<void (cc::ProxyMain::*)(std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> >), base::WeakPtr<cc::ProxyMain>, std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> > > base/bind_internal.h:285
#8 0x10cac310c in void base::internal::Invoker<base::internal::BindState<void (cc::ProxyMain::*)(std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> >), base::WeakPtr<cc::ProxyMain>, base::internal::PassedWrapper<std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> > > >, void ()>::RunImpl<void (cc::ProxyMain::*)(std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> >), std::__1::tuple<base::WeakPtr<cc::ProxyMain>, base::internal::PassedWrapper<std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> > > >, 0ul, 1ul>(void (cc::ProxyMain::*&&)(std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> >), std::__1::tuple<base::WeakPtr<cc::ProxyMain>, base::internal::PassedWrapper<std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> > > >&&, base::IndexSequence<0ul, 1ul>) base/bind_internal.h:340
"""

ClusterFuzz has detected this issue as fixed in range 492866:493054.

Detailed report: https://clusterfuzz.com/testcase?key=6308253846994944

Fuzzer: marty_html_twiddler
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000098
Crash State:
  _platform_memmove$VARIANT$Nehalem
  cc::draw_property_utils::ComputeClips
  cc::LayerTreeHost::DoUpdateLayers
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=492830:492866
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=492866:493054

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6308253846994944

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6308253846994944 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.