With reference to the following   Issue 765581  , assigning it to lukasza@

lukasza@ Could you please look into it

Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

I think I understand what is going on.

A layout test like below

    <script>
    testRunner.dumpAsText();
    testRunner.dumpChildFramesAsText();
    window.close();
    </script>

will hit the following callstack:

    #1 content::WebContentsObserver::Observe(nullptr) content/public/browser/web_contents_observer.cc:47:35
    #2 content::BlinkTestController::DiscardMainWindow() content/shell/browser/layout_test/blink_test_controller.cc:705:24
    #3 content::BlinkTestController::WebContentsDestroyed() content/shell/browser/layout_test/blink_test_controller.cc:628:3
    #4 content::WebContentsImpl::~WebContentsImpl() content/browser/web_contents/web_contents_impl.cc:675:14

which means that subsequent calls to WebContentsObserver::web_contents() will return nullptr.  This includes the call found by ClusterFuzz in content::BlinkTestController::OnDumpFrameLayoutResponse.

WIP CL with a fix: https://chromium-review.googlesource.com/c/chromium/src/+/879090

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1809d4e5893a50db5b7fb33a158bb4391f75d383

commit 1809d4e5893a50db5b7fb33a158bb4391f75d383
Author: Lukasz Anforowicz <lukasza@chromium.org>
Date: Wed Jan 24 17:22:26 2018

Gracefully handle closing of test window while gathering layout dump.

Bug:  798598 
Change-Id: I3d312c0e0ffe589ed63eb9c93c01314744fe0fd9
Reviewed-on: https://chromium-review.googlesource.com/879090
Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Cr-Commit-Position: refs/heads/master@{#531581}
[modify] https://crrev.com/1809d4e5893a50db5b7fb33a158bb4391f75d383/content/shell/browser/layout_test/blink_test_controller.cc
[add] https://crrev.com/1809d4e5893a50db5b7fb33a158bb4391f75d383/third_party/WebKit/LayoutTests/fast/dom/Window/window-closed-during-layout-dump-expected.txt
[add] https://crrev.com/1809d4e5893a50db5b7fb33a158bb4391f75d383/third_party/WebKit/LayoutTests/fast/dom/Window/window-closed-during-layout-dump.html

ClusterFuzz has detected this issue as fixed in range 531577:531603.

Detailed report: https://clusterfuzz.com/testcase?key=6564055795105792

Fuzzer: ochang_domfuzzer
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  content::BlinkTestController::OnDumpFrameLayoutResponse
  content::mojom::LayoutTestControl_DumpFrameLayout_ForwardToCallback::Accept
  mojo::InterfaceEndpointClient::HandleValidatedMessage
  
Sanitizer: address (ASAN)

Fixed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=531577:531603

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6564055795105792

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6564055795105792 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.