Suspected CL could be https://chromium.googlesource.com/chromium/src/+/673555a5d9c7a1bc26dc67813e1110cdc2e07268

Assigning to the reviewer of the CL yosin@. could you please have a look and reassign if needed.

Thank you.

ClusterFuzz has detected this issue as fixed in range 431480:431542.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5806108581298176

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  a.isNotNull() in EditingUtilities.cpp
  blink::comparePositions
  blink::CompositeEditCommand::moveParagraphWithClones
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=283188:283414
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=431480:431542

Minimized Testcase (0.29 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97e0g0Si1rig-sdpxHw3LmZ_ywGne2MwxrMAdMhtgMDG6k0ShheRY4eL7lbr_QDyIDZzL0YTmyotxo4MDE8qHaNTJlWC6Inf8qbOtfyuL9DXmsoXRB_awY7C7LHnZRIDA57-0pg2AQzsgfiS84hM_KU9OO49A?testcase_id=5806108581298176
<style>
   ul.collapse {
    visibility:hidden;
}
li:first-child {
    visibility:visible;
</style>
  <script>
window.onload = function() {
    document.designMode = 'on';
    document.execCommand('SelectAll');
    document.execCommand('Indent', false);
};
  </script>
 <ul class="collapse">
   <li>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot