Interesting. id_a in this case is 0xA0 (kWebMIdBlockGroup). Investigating.

Possible fix: https://chromium-review.googlesource.com/c/chromium/src/+/660410

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/52fc7b2652c2fbc70a4efded0fa91b348fdc325b

commit 52fc7b2652c2fbc70a4efded0fa91b348fdc325b
Author: Matt Wolenetz <wolenetz@chromium.org>
Date: Mon Sep 11 21:01:06 2017

MSE: Change IsSiblingOrAncestor DCHECK failure to parse error

The context of this DCHECK strongly implies that the stream is malformed
if the DCHECK failed; the conditions in the DCHECK were not enforced by
callers either. This change makes the DCHECK's failing condition instead
be a parse error (in Release builds, too.)

In particular, if the WebM stream is parsing an unknown-sized blockgroup
list, the blockgroup can only be terminated by another immediate
child element type of a cluster, or another cluster, segment or EBML
header. This may regress previously supported streams which terminated
unknown-length list entry element types (like block groups) with other
elements that would otherwise be valid in context.

BUG= 763574 

Change-Id: I3fbc257847e217ea01f0541e2e2ab9202044f153
Reviewed-on: https://chromium-review.googlesource.com/660410
Reviewed-by: Chrome Cunningham <chcunningham@chromium.org>
Commit-Queue: Matthew Wolenetz <wolenetz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#501039}
[modify] https://crrev.com/52fc7b2652c2fbc70a4efded0fa91b348fdc325b/media/formats/webm/webm_parser.cc
[modify] https://crrev.com/52fc7b2652c2fbc70a4efded0fa91b348fdc325b/media/formats/webm/webm_parser.h

#4 should fix this. Pending CF verification...

ClusterFuzz has detected this issue as fixed in range 500987:501057.

Detailed report: https://clusterfuzz.com/testcase?key=4900337441046528

Fuzzer: libFuzzer_mediasource_WEBM_VP9_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  (id_a == kWebMIdSegment) || (id_a == kWebMIdCluster) in webm_parser.cc
  base::debug::DebugBreak
  media::WebMListParser::IsSiblingOrAncestor
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=497039:497107
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=500987:501057

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4900337441046528

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4900337441046528 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.