Predator and CL could not provide any possible suspects.

Using Code Search for the file, "security_origin.cc" suspecting the below Cl might have caused this issue

Suspect CL: https://chromium.googlesource.com/chromium/src/+/00107ca537f9125c45dc16f23cad6a0ed0347aa7

dcheng@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!

That doesn't seem to related to DOM.

I suspect, for some reason, the SecurityOrigin is null (there's a DCHECK in the previous line that this is true).

+dgozman, do you mind looking at this, since you've been doing some work in this area?

Hmm... RenderFrameImpl::DidStartProvisionalLoad expects RequestorOrigin to be non-null, although nobody guarantees that. It might be null when someone calls WebLocalFrame::StartNavigation (like in this case), or WebLocalFrame::CommitNavigation, or various LoadFoo methods.

+kinuko, who introduced the assumption in [1]. Are we sure it should never be null?

Meanwhile, I have a patch to fix this particular layouttest-only problem [2].

[1] https://chromium.googlesource.com/chromium/src/+/74a7fb2fa4307c69812945586b39018ae4f231b2%5E%21/#F1
[2] https://chromium-review.googlesource.com/c/chromium/src/+/1135642

ClusterFuzz has detected this issue as fixed in range 574649:574651.

Detailed report: https://clusterfuzz.com/testcase?key=5686287336734720

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000024
Crash State:
  blink::SecurityOrigin::ToUrlOrigin
  blink::WebSecurityOrigin::operator url::Origin
  content::RenderFrameImpl::BeginNavigation
  
Sanitizer: address (ASAN)

Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=574649:574651

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5686287336734720

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5686287336734720 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Looks like this was fixed by https://chromium-review.googlesource.com/1130223.