Predator and CL could not provide any possible suspects.

Using Code Search for the file, "PaintPropertyNode.h" suspecting the below Cl might have caused this issue

Suspect CL: https://chromium.googlesource.com/chromium/src/+/1ce8d72d66f3dfce63347f20b1fae45c91c65a4c%5E%21/third_party/WebKit/Source/platform/graphics/paint/PaintPropertyNode.h

wangxianzhu@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!

Lowering priority because the test case is too big and can't stably reproduce the issue.

 bug 831634  has a better test case.

ClusterFuzz has detected this issue as fixed in range 555311:555312.

Detailed report: https://clusterfuzz.com/testcase?key=5366889069674496

Fuzzer: ifratric-browserfuzzer-v3
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x000000000008
Crash State:
  blink::LowestCommonAncestor<class blink::ClipPaintPropertyNode>
  blink::ConversionContext::SwitchToClip
  blink::GraphicsLayer::PaintContents
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=547394:547395
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=555311:555312

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5366889069674496

Additional requirements: Requires Gestures

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.