From findit tool:

Author: mstensho
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/f9ae8afc886232819001f274825a6c55d7fc8482
Time: Fri Apr 22 17:02:27 2016
The CL last changed line 108 of file ColumnBalancer.cpp, which is stack frame 2.

Author: mstensho
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/f9ae8afc886232819001f274825a6c55d7fc8482
Time: Fri Apr 22 17:02:27 2016
The CL last changed line 72 of file ColumnBalancer.cpp, which is stack frame 3.

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5787399250771968

Fuzzer: inferno_twister
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  isBreakBetweenControllable(previousBreakAfterValue)
  blink::LayoutBox::classABreakPointValue
  blink::LayoutBox::needsForcedBreakBefore
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=385949:385978

Minimized Testcase (1.12 Kb): https://cluster-fuzz.appspot.com/download/AMIfv966t6jEvuTrKnQwcI-8Euei6f6mLrE7Cp8o7Ien8RkZ84x3GAVgzp4exayBCduYnglV6l2zPiosI9IWXJ6zYbg8-j4aeYNMWy4GfxYlLRPYWpgyl13cjUTjYRgPX8OCLRCv2NEkv9n99OQG0qHgBB1sEDUjJA?testcase_id=5787399250771968

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6169805617102848

Fuzzer: bj_broddelwerk
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  isBreakBetweenControllable(previousBreakAfterValue)
  blink::LayoutBox::classABreakPointValue
  blink::LayoutBox::needsForcedBreakBefore
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=385949:385978

Minimized Testcase (0.42 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95hxURqfobHyXsxDw8xL79aQTTcZfteKiOYyFPTWym3rnb3YgmNWFoTj0RoJOzLFfxjqOhQRdXbMv3PPknH7YCz_xYUKBAXb-ndGPZ_28xCZlNmvus05yi_5go8_LDhiaEPUw757VueCuCT0Y_z2PKAs7OPIg?testcase_id=6169805617102848

Filer: mummareddy

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Reproduced.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/194b775563c7c3ecff9ba92187aa7ca3d330b303

commit 194b775563c7c3ecff9ba92187aa7ca3d330b303
Author: mstensho <mstensho@opera.com>
Date: Tue Aug 09 16:44:16 2016

There's no class A break point before or after a float.

LayoutBox::classABreakPointValue() should only be called at class A break
points. Document the assertion there, and make sure that
needsForcedBreakBefore() only calls it when at in-flow objects.

BUG= 619152 
R=eae@chromium.org

Review-Url: https://codereview.chromium.org/2228803003
Cr-Commit-Position: refs/heads/master@{#410703}

[add] https://crrev.com/194b775563c7c3ecff9ba92187aa7ca3d330b303/third_party/WebKit/LayoutTests/fast/multicol/balance-float-after-forced-break-expected.html
[add] https://crrev.com/194b775563c7c3ecff9ba92187aa7ca3d330b303/third_party/WebKit/LayoutTests/fast/multicol/balance-float-after-forced-break.html
[modify] https://crrev.com/194b775563c7c3ecff9ba92187aa7ca3d330b303/third_party/WebKit/Source/core/layout/LayoutBox.cpp

ClusterFuzz has detected this issue as fixed in range 410634:410757.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6169805617102848

Fuzzer: bj_broddelwerk
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  isBreakBetweenControllable(previousBreakAfterValue)
  blink::LayoutBox::classABreakPointValue
  blink::LayoutBox::needsForcedBreakBefore
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=385949:385978
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=410634:410757

Minimized Testcase (0.42 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95hxURqfobHyXsxDw8xL79aQTTcZfteKiOYyFPTWym3rnb3YgmNWFoTj0RoJOzLFfxjqOhQRdXbMv3PPknH7YCz_xYUKBAXb-ndGPZ_28xCZlNmvus05yi_5go8_LDhiaEPUw757VueCuCT0Y_z2PKAs7OPIg?testcase_id=6169805617102848

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot