Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.

I haven't succeeded in reproducing this with the reproduction case.
On windows, built with args.gn (GN options) specified in clusterfuzz page
and ran
> out\Default\content_shell.exe --js-flags=--expose-gc <...testcase-dir...>\fuzz-crossfuzz-796048764.html
but running it several minutes didn't reproduce the Null deref.

Considering the backtrace, can anyone in media capture take a look?

Test Predator has given the following results:

Implement beforeprint/afterprint events. by tkent@chromium.org
Changed files interfaces-expected.txt, with the same CrashedDirectory(third_party/WebKit/Source/core/dom) as TaskRunnerHelper.cpp (in frame#0)

@tkent -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes. (CC'd the reviewers of the changes as tkent@ is OOO)

Thank You.

More likely r499706.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/dfda299cc537c1e0c1e73106ceb8dfe5336a501f

commit dfda299cc537c1e0c1e73106ceb8dfe5336a501f
Author: Nate Chapin <japhet@chromium.org>
Date: Fri Oct 06 23:42:49 2017

Fix crash when calling captureStream() on detached canvas.

Bug:  770477 
Test: http/tests/canvas/captureStream-on-detached-canvas.html
Change-Id: I233ad340e2ab65be4a1b121cfa93e099611e79d1
Reviewed-on: https://chromium-review.googlesource.com/701255
Reviewed-by: Emircan Uysaler <emircan@chromium.org>
Commit-Queue: Nate Chapin <japhet@chromium.org>
Cr-Commit-Position: refs/heads/master@{#507226}
[add] https://crrev.com/dfda299cc537c1e0c1e73106ceb8dfe5336a501f/third_party/WebKit/LayoutTests/http/tests/canvas/captureStream-on-detached-canvas-expected.txt
[add] https://crrev.com/dfda299cc537c1e0c1e73106ceb8dfe5336a501f/third_party/WebKit/LayoutTests/http/tests/canvas/captureStream-on-detached-canvas.html
[add] https://crrev.com/dfda299cc537c1e0c1e73106ceb8dfe5336a501f/third_party/WebKit/LayoutTests/http/tests/canvas/resources/iframe-with-canvas.html
[modify] https://crrev.com/dfda299cc537c1e0c1e73106ceb8dfe5336a501f/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.cpp
[modify] https://crrev.com/dfda299cc537c1e0c1e73106ceb8dfe5336a501f/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.h
[modify] https://crrev.com/dfda299cc537c1e0c1e73106ceb8dfe5336a501f/third_party/WebKit/Source/modules/mediacapturefromelement/HTMLCanvasElementCapture.cpp

ClusterFuzz has detected this issue as fixed in range 507041:507062.

Detailed report: https://clusterfuzz.com/testcase?key=4930641270669312

Fuzzer: lcamtuf_cross_fuzz
Job Type: windows_asan_chrome
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x00000000
Crash State:
  blink::TaskRunnerHelper::Get
  blink::TimedCanvasDrawListener::TimedCanvasDrawListener
  blink::TimedCanvasDrawListener::Create
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=504594:504637
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=507041:507062

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4930641270669312

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4930641270669312 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.