This issue looks similar to bug 813531, hence assigning to the same owner for more updates on it.

dcheng@ Could you please take a look in to this issue?

Thanks!

ClusterFuzz has detected this issue as fixed in range 565786:565789.

Detailed report: https://clusterfuzz.com/testcase?key=5423168450461696

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !frame_ || frame_->Tree().ChildCount() == 0 in Document.cpp
  blink::Document::Shutdown
  blink::XSLTProcessor::CreateDocumentFromSource
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=538973:538977
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=565786:565789

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5423168450461696

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5423168450461696 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.