kotenkov@, i am not very sure this is also 'Dupe' of https://bugs.chromium.org/p/chromium/issues/detail?id=606515 ? However the root cause looks similar?

Thank you!

Route to Editing triage

Since FrameSelection depends on layout tree, clients of FrameSelection should check layout objects available for selection.

In the sample, FrameSelection has no layout objects, they are removed by |test.style.display='none'|

Lower to Pri-2, the scenario to reproduce isn't usual.

ClusterFuzz has detected this issue as fixed in range 408050:408071.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5385491528024064

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  start <= end in PlainTextRange.cpp
  blink::PlainTextRange::PlainTextRange
  blink::PlainTextRange::create
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=283188:283414
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=408050:408071

Minimized Testcase (0.42 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94s9uPiSAkVuXWWB9mykr4ID1rJuENtziZgrjk9ZLdUYytCH-mzJPfPRW4gqLFkppjZf42i4t9ZBjRYFd8LfEOiN-dwm9DtD_65MQTpPSE3g24MR6wGRqDlC4Uwq704kjDeAzkiYznx4m7X60rd1oVYK6mNFQ?testcase_id=5385491528024064
<div id="test" contenteditable></div>
<pre>
<script>
function runSingleTest( isStart) {
    test.innerHTML = '<span>hello</span> world';
    var selection = window.getSelection();
        selection.setBaseAndExtent(test.firstChild.firstChild, 2, test.lastChild, 3);
}
function runTestPairs() {
        runSingleTest();
}
function runTests() {
    runTestPairs();
}
runTests();
test.style.display = 'none';
</script>



See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot