As per the  Issue 777113  owner, assigning this issue to @wangxianzhu.
@wangxianzhu -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.
Thanks.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/dc925dc985519da05923977f7c2b0e047e3ee6b3

commit dc925dc985519da05923977f7c2b0e047e3ee6b3
Author: Xianzhu Wang <wangxianzhu@chromium.org>
Date: Fri Nov 17 06:10:31 2017

[PE] Invalidate composited scroll corner layer when 'resize' style change

Bug:  781508 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_root_layer_scrolls;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I792d53b913abd981759be2473a3e450889181ff2
Reviewed-on: https://chromium-review.googlesource.com/775034
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Reviewed-by: Philip Rogers <pdr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#517322}
[modify] https://crrev.com/dc925dc985519da05923977f7c2b0e047e3ee6b3/third_party/WebKit/LayoutTests/TestExpectations
[add] https://crrev.com/dc925dc985519da05923977f7c2b0e047e3ee6b3/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/scroll/composited-add-resizer-expected.txt
[add] https://crrev.com/dc925dc985519da05923977f7c2b0e047e3ee6b3/third_party/WebKit/LayoutTests/flag-specific/root-layer-scrolls/paint/invalidation/scroll/composited-add-resizer-expected.txt
[add] https://crrev.com/dc925dc985519da05923977f7c2b0e047e3ee6b3/third_party/WebKit/LayoutTests/paint/invalidation/scroll/composited-add-resizer-expected.html
[add] https://crrev.com/dc925dc985519da05923977f7c2b0e047e3ee6b3/third_party/WebKit/LayoutTests/paint/invalidation/scroll/composited-add-resizer-expected.txt
[add] https://crrev.com/dc925dc985519da05923977f7c2b0e047e3ee6b3/third_party/WebKit/LayoutTests/paint/invalidation/scroll/composited-add-resizer.html
[add] https://crrev.com/dc925dc985519da05923977f7c2b0e047e3ee6b3/third_party/WebKit/LayoutTests/virtual/spv175/paint/invalidation/scroll/composited-add-resizer-expected.txt
[modify] https://crrev.com/dc925dc985519da05923977f7c2b0e047e3ee6b3/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
[modify] https://crrev.com/dc925dc985519da05923977f7c2b0e047e3ee6b3/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.h

ClusterFuzz has detected this issue as fixed in range 514498:517698.

Detailed report: https://clusterfuzz.com/testcase?key=5791165474668544

Fuzzer: inferno_twister
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false. Can't find cached display item in PaintController.cpp
  blink::PaintController::FindOutOfOrderCachedItemForward
  blink::PaintController::UseCachedDrawingIfPossible
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=513950:513979
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=514498:517698

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5791165474668544

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5791165474668544 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.