Testcase 4636438141599744 is a top crash on ClusterFuzz for windows platform. Please prioritize fixing this crash.

Marking this crash as a stable release blocker. If this is incorrect, remove the ReleaseBlock label.

Predator could not provide any possible suspects.
Assigning to concern owner from CL --
https://chromium.googlesource.com/chromium/src/+log/69a14991d90732092083877f9f164ab3f7fc5aac..c3a3481c4b1b08775b477144d1d2873a2a3d9900?pretty=fuller&n=10000

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/c3a3481c4b1b08775b477144d1d2873a2a3d9900

@chrishtr -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

 Issue 763656  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bb10fad71904e8baa5870296d026de903a285620

commit bb10fad71904e8baa5870296d026de903a285620
Author: Chris Harrelson <chrishtr@chromium.org>
Date: Tue Sep 12 02:13:03 2017

Fix crash when number of columns changes.

Bug:  763654 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: Ida1979f9418c95c3b38db423f3bf777186cbb86a
Reviewed-on: https://chromium-review.googlesource.com/660407
Reviewed-by: Tien-Ren Chen <trchen@chromium.org>
Commit-Queue: Chris Harrelson <chrishtr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#501154}
[add] https://crrev.com/bb10fad71904e8baa5870296d026de903a285620/third_party/WebKit/LayoutTests/fast/multicol/change-column-count-crash.html
[modify] https://crrev.com/bb10fad71904e8baa5870296d026de903a285620/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

ClusterFuzz has detected this issue as fixed in range 501100:501156.

Detailed report: https://clusterfuzz.com/testcase?key=4636438141599744

Fuzzer: ochang_domfuzzer
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x00000000
Crash State:
  blink::PropertyTreeState::operator=
  blink::PaintLayerClipper::CalculateRects
  blink::PaintLayer::CollectFragmentsForPaint
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=500790:500792
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=501100:501156

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4636438141599744

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4636438141599744 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.