Test Predator has given the following results:

Replace RefPtr<>::Get() with get() in core/{dom,frame,html}/ by tzik@chromium.org
Changelist touched lines near the crashed line in frame #5 blink::HTMLDocumentParser::HTMLDocumentParser(blink::Document&, blink::ParserContentPolicy, blink::ParserSynchronizationPolicy) (distance = 0 lines away)
Top touched frame is #3 blink::LocalDOMWindow::InstallNewDocument(in LocalDOMWindow.cpp)
Changed files History.cpp, HistoryTest.cpp, LocalDOMWindow.cpp, LocalFrameView.h, MHTMLTest.cpp, SuspendableScriptExecutor.cpp, WebFrameWidgetImpl.cpp, WebViewFrameWidget.cpp, with the same CrashedDirectory(third_party/WebKit/Source/core/frame) as WebLocalFrameImpl.cpp (in frame#9, frame#10), LocalDOMWindow.cpp (in frame#3, frame#6) Changed files HTMLDocumentParser.cpp, HTMLDocumentParser.h, HTMLTreeBuilder.cpp, with the same CrashedDirectory(third_party/WebKit/Source/core/html/parser) as TokenizedChunkQueue.h (in frame#4), HTMLDocumentParser.h (in frame#7), HTMLDocumentParser.cpp (in frame#5, frame#6), BackgroundHTMLParser.cpp (in frame#4), HTMLParserReentryPermit.cpp (in frame#4)
Touched files in stacktrace - HTMLDocumentParser.cpp, HTMLDocumentParser.h, LocalDOMWindow.cpp
Changed files History.cpp, HistoryTest.cpp, LocalDOMWindow.cpp, LocalFrameView.h, MHTMLTest.cpp, SuspendableScriptExecutor.cpp, WebFrameWidgetImpl.cpp, WebViewFrameWidget.cpp, ContentSecurityPolicy.cpp, ContentSecurityPolicyTest.cpp, with the same CrashedComponent(Blink>Internals) as WebLocalFrameImpl.cpp (in frame#9, frame#10), LocalDOMWindow.cpp (in frame#3, frame#6) Changed files HTMLDocumentParser.cpp, HTMLDocumentParser.h, HTMLTreeBuilder.cpp, with the same CrashedComponent(Blink>HTML>Parser) as TokenizedChunkQueue.h (in frame#4), HTMLDocumentParser.h (in frame#7), HTMLDocumentParser.cpp (in frame#5, frame#6), BackgroundHTMLParser.cpp (in frame#4), HTMLParserReentryPermit.cpp (in frame#4)

@tzik -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.

Thank You.

Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.

ClusterFuzz has detected this issue as fixed in range 505602:505631.

Detailed report: https://clusterfuzz.com/testcase?key=5588785147674624

Fuzzer: libFuzzer_renderer_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  blink::WebTaskRunner::PostCancellableTask
  blink::Resource::AddClient
  blink::DocumentLoader::StartLoading
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=504956:504991
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=505602:505631

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5588785147674624

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5588785147674624 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.