Using the provided regression range assigning to the possible suspect as per the change made for the file, "RasterInvalidationTracking.cpp" and “GraphicsLayer.cpp”
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/4445396a3948d26047d3893031cc78ac24e6671c
@wangxianzhu -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.

Lowering priority because the related code is for testing only.

ClusterFuzz has detected this issue as fixed in range 509467:509527.

Detailed report: https://clusterfuzz.com/testcase?key=5647428966678528

Fuzzer: mbarbella_js_mutation_layout
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x00000008
Crash State:
  blink::RasterInvalidationTracking::AsJSON
  blink::GraphicsLayer::LayerAsJSONInternal
  blink::GraphicsLayer::LayerTreeAsJSONInternal
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=506865:506957
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=509467:509527

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5647428966678528

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5647428966678528 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.