Using the provided regression range assigning to the possible suspect as per the change made for the file, “PaintInvalidator.cpp”.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/bc49021b12f8c83ebfab26d374f164b9452b7b09

@wangxianzhu  -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.

 Issue 764695  has been merged into this issue.

Testcase 6621796303634432 is a top crash on ClusterFuzz for windows platform. Please prioritize fixing this crash.

Marking this crash as a stable release blocker. If this is incorrect, remove the ReleaseBlock label.

The CL causing the crash has been reverted: https://chromium-review.googlesource.com/c/chromium/src/+/664321.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/028f963b42a147c8affd442432e13c9c5ef5d11a

commit 028f963b42a147c8affd442432e13c9c5ef5d11a
Author: Xianzhu Wang <wangxianzhu@chromium.org>
Date: Wed Sep 13 21:46:01 2017

Reland "Invalidate partial rectangle during paint invalidation"

This reverts commit e6c43e952806dc1dfa59380d7445f67dbd139587.

Fixed the original bug by calling SetMayNeedInvalidation() instead of
SetMayNeedPaintInvalidationWithoutGeometryChange() in LayoutObject::
InvalidatePaintRectangle().

Also removed unnecessary DisablePaintInvalidationStateAsserts for
InvalidatePaintRectangle() which now doesn't immediately invalidate.

Original change's description:
> Revert "Invalidate partial rectangle during paint invalidation"
> 
> This reverts commit bc49021b12f8c83ebfab26d374f164b9452b7b09.
> 
> Reason for revert: Caused SEGV in browser_tests and webkit_layout_tests.
> 
> https://uberchromegw.corp.google.com/i/chromium.chromiumos/builders/Linux%20ChromiumOS%20Tests%20%281%29/builds/44465
> https://uberchromegw.corp.google.com/i/chromium.mac/builders/Mac10.12%20Tests/builds/5207
> https://uberchromegw.corp.google.com/i/chromium.webkit/builders/WebKit%20Linux%20Trusty/builds/32519
> 
> 
> Original change's description:
> > Invalidate partial rectangle during paint invalidation
> > 
> > Record partial invalidation rectangle in LayoutObject::
> > InvalidatePaintRectangle(). During paint invalidation, get the rect and
> > invalidate it.
> > 
> > This CL is for SPv1, and prepares for SPv2 partial raster invalidation.
> > 
> > Bug:  732612 
> > Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
> > Change-Id: I65b96e47fa105258e6f677e2923c361585ecfbda
> > Reviewed-on: https://chromium-review.googlesource.com/663977
> > Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
> > Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#501548}
> 
> TBR=wangxianzhu@chromium.org,chrishtr@chromium.org
> 
> Change-Id: I53140c2754ca3cf9cc29cf15f2284dc4fa39a14e
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug:  732612 
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
> Reviewed-on: https://chromium-review.googlesource.com/664321
> Reviewed-by: Kunihiko Sakamoto <ksakamoto@chromium.org>
> Commit-Queue: Kunihiko Sakamoto <ksakamoto@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#501560}

Change-Id: Id70bba820dc832c59c4704e41edd16e680542894
Bug:  732612 ,  457415 ,  764676 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Reviewed-on: https://chromium-review.googlesource.com/664821
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#501762}
[modify] https://crrev.com/028f963b42a147c8affd442432e13c9c5ef5d11a/third_party/WebKit/Source/core/exported/WebPluginContainerImpl.cpp
[modify] https://crrev.com/028f963b42a147c8affd442432e13c9c5ef5d11a/third_party/WebKit/Source/core/exported/WebPluginContainerImpl.h
[modify] https://crrev.com/028f963b42a147c8affd442432e13c9c5ef5d11a/third_party/WebKit/Source/core/frame/LocalFrameView.cpp
[modify] https://crrev.com/028f963b42a147c8affd442432e13c9c5ef5d11a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
[modify] https://crrev.com/028f963b42a147c8affd442432e13c9c5ef5d11a/third_party/WebKit/Source/core/layout/LayoutObject.h
[modify] https://crrev.com/028f963b42a147c8affd442432e13c9c5ef5d11a/third_party/WebKit/Source/core/paint/HTMLCanvasPaintInvalidator.cpp
[modify] https://crrev.com/028f963b42a147c8affd442432e13c9c5ef5d11a/third_party/WebKit/Source/core/paint/ObjectPaintInvalidator.cpp
[modify] https://crrev.com/028f963b42a147c8affd442432e13c9c5ef5d11a/third_party/WebKit/Source/core/paint/ObjectPaintInvalidator.h
[modify] https://crrev.com/028f963b42a147c8affd442432e13c9c5ef5d11a/third_party/WebKit/Source/core/paint/ObjectPaintInvalidatorTest.cpp
[modify] https://crrev.com/028f963b42a147c8affd442432e13c9c5ef5d11a/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
[modify] https://crrev.com/028f963b42a147c8affd442432e13c9c5ef5d11a/third_party/WebKit/Source/core/paint/RarePaintData.h
[modify] https://crrev.com/028f963b42a147c8affd442432e13c9c5ef5d11a/third_party/WebKit/Source/core/paint/compositing/PaintLayerCompositor.cpp

ClusterFuzz has detected this issue as fixed in range 501548:501560.

Detailed report: https://clusterfuzz.com/testcase?key=6621796303634432

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x00000000
Crash State:
  blink::PaintInvalidator::MapLocalRectToVisualRectInBacking<class blink::LayoutRe
  blink::PaintInvalidatorContext::MapLocalRectToVisualRectInBacking
  blink::ObjectPaintInvalidatorWithContext::InvalidatePartialRect
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=501529:501548
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=501548:501560

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6621796303634432

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6621796303634432 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.