Predator could not provide any possible suspects.
Assigning to the concern owner from CL --
https://chromium.googlesource.com/chromium/src/+log/e6d5827bc0e3a428d64eeadebb363bd003c5e361..07e7c1ff8be6192fdb41d50f604d88c7f6bdf1ea?pretty=fuller&n=10000

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/e3d9eee91f3dfe5503bde5f3f4fc776e1552f857

@enne -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

It looks like this is generating a DrawArcOp with an sweepAngle of -1e29.  This ends up in this forever while loop in skia attempting to get to > 360 value.  This seems to be valid, as drawArc's sweep angle (according to SkCanvas comments) can loop repeatedly.

However, the only caller of DrawArcOp (!!) is https://cs.chromium.org/chromium/src/ash/system/network/network_icon.cc?sq=package:chromium&l=708.

It seems like this can be replaced with a DrawPath.

The missing detail is that every loop allocates more points on a path, which eventually OOMs.

https://cs.chromium.org/chromium/src/third_party/skia/src/core/SkPath.cpp?q=skpath.cpp&sq=package:chromium&dr&l=3401

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/eeaa46bad3bc9b26de3f4ce9b1d8901385cbce9c

commit eeaa46bad3bc9b26de3f4ce9b1d8901385cbce9c
Author: Adrienne Walker <enne@chromium.org>
Date: Wed Aug 23 23:08:27 2017

Remove PaintCanvas::drawArc

There's only one (!!) caller of PaintCanvas::drawArc, so replace that
with an equivalent drawPath.

This is the same code that Skia does internally in
SkPathPriv::CreateDrawArcPath for drawArcs.  However, drawArc has
different semantics than SkPath::arcTo, in that extremely sweep angles
do not get a % operator applied to them, so that extremely large sweep
angles will loop forever while trying to generate a path.

Tested manually by looking at the network indicator icon on a
Linux build of chromeos.

Bug:  756727 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Idfe7107b166e902ad9e66c4d922889c15c124da2
Reviewed-on: https://chromium-review.googlesource.com/629519
Reviewed-by: Philip Rogers <pdr@chromium.org>
Reviewed-by: Vladimir Levin <vmpstr@chromium.org>
Reviewed-by: Sadrul Chowdhury <sadrul@chromium.org>
Commit-Queue: enne <enne@chromium.org>
Cr-Commit-Position: refs/heads/master@{#496851}
[modify] https://crrev.com/eeaa46bad3bc9b26de3f4ce9b1d8901385cbce9c/ash/system/network/network_icon.cc
[modify] https://crrev.com/eeaa46bad3bc9b26de3f4ce9b1d8901385cbce9c/cc/paint/paint_canvas.h
[modify] https://crrev.com/eeaa46bad3bc9b26de3f4ce9b1d8901385cbce9c/cc/paint/paint_op_buffer.cc
[modify] https://crrev.com/eeaa46bad3bc9b26de3f4ce9b1d8901385cbce9c/cc/paint/paint_op_buffer.h
[modify] https://crrev.com/eeaa46bad3bc9b26de3f4ce9b1d8901385cbce9c/cc/paint/paint_op_buffer_unittest.cc
[modify] https://crrev.com/eeaa46bad3bc9b26de3f4ce9b1d8901385cbce9c/cc/paint/record_paint_canvas.cc
[modify] https://crrev.com/eeaa46bad3bc9b26de3f4ce9b1d8901385cbce9c/cc/paint/record_paint_canvas.h
[modify] https://crrev.com/eeaa46bad3bc9b26de3f4ce9b1d8901385cbce9c/cc/paint/skia_paint_canvas.cc
[modify] https://crrev.com/eeaa46bad3bc9b26de3f4ce9b1d8901385cbce9c/cc/paint/skia_paint_canvas.h
[modify] https://crrev.com/eeaa46bad3bc9b26de3f4ce9b1d8901385cbce9c/cc/paint/solid_color_analyzer.cc
[modify] https://crrev.com/eeaa46bad3bc9b26de3f4ce9b1d8901385cbce9c/third_party/WebKit/Source/platform/graphics/test/MockPaintCanvas.h

ClusterFuzz has detected this issue as fixed in range 496804:496885.

Detailed report: https://clusterfuzz.com/testcase?key=4982377544941568

Fuzzer: libFuzzer_paint_op_buffer_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Out-of-memory (exceeds 2048 MB)
Crash Address: 
Crash State:
  paint_op_buffer_fuzzer
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=491850:491931
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=496804:496885

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4982377544941568

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4982377544941568 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.