Predator and CL could not provide any possible suspects.

Using Code Search for the file, "web_view_frame_widget.cc" suspecting the below Cl might have caused this issue

Suspect CL: https://chromium.googlesource.com/chromium/src/+/3b9e1bb4fb288fb0142f6c030daf4fad40e42ec7%5E%21/third_party/blink/renderer/core/frame/web_view_frame_widget.cc

jbroman@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!

This is a test only feature not in shipping Chrome (I presume). So not a P1. Null deref is not a P1 anyway.

jbroman@, do you want to re-assign?

Fix looks easy. Lemme just try and deal with it that way.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a58cbf80d4fcfaf8dc626f533046e856389524bc

commit a58cbf80d4fcfaf8dc626f533046e856389524bc
Author: Jeremy Roman <jbroman@chromium.org>
Date: Tue Jun 12 19:29:11 2018

Skip requests for test callbacks from the layer tree view if it is closed.

Bug:  851647 
Change-Id: Id7acf348daf9a2af3a961a59643593b40da686a3
Reviewed-on: https://chromium-review.googlesource.com/1097227
Reviewed-by: Stephen Chenney <schenney@chromium.org>
Commit-Queue: Jeremy Roman <jbroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#566529}
[modify] https://crrev.com/a58cbf80d4fcfaf8dc626f533046e856389524bc/third_party/blink/renderer/core/exported/web_view_impl.cc

ClusterFuzz has detected this issue as fixed in range 566528:566529.

Detailed report: https://clusterfuzz.com/testcase?key=4766018812248064

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_ubsan_vptr_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::WebViewImpl::LayoutAndPaintAsync
  blink::WebViewFrameWidget::LayoutAndPaintAsync
  test_runner::LayoutAndPaintAsyncThen
  
Sanitizer: undefined (UBSAN)

Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=566528:566529

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4766018812248064

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4766018812248064 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.