Change Log::
===============
https://chromium.googlesource.com/chromium/src/+log/c4dc398543c8a7cbd4b5f8bfe3495d6182dc3f19..b500a03626e0b462127118e12ea9fb294fee6829?pretty=fuller

Possible suspect from the above CL
https://codereview.chromium.org/2082503003

kotenkov@ Please look into this issue if it is related to your change,else please re assign to an appropriate owner for this issue.

Thanks,

Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Reassigning to yosin since I've only converted the checks.

Lower to Pri-2, since real world usage of InsertHorizontalRule is low.

DOM tree at assertion:
#document	000001117D5C24A0 (editable)
	HTML	000001117D5C2FD0 (editable)
		HEAD	000001117D5C3038 (editable)
			STYLE	000001117D5C30A0 (editable)
				#text	000001117D5C3678 "*"
				HR	000001117D5C35A8 (editable)
SE				#text	000001117D5C3130 "{-webkit-animation-timing-function:initial;display:inline-block;"
			#text	000001117D5C3180 "\n"
			SCRIPT	000001117D5C31D0 (editable)
				#text	000001117D5C3248 "...script.."
		switch	000001117D5C3348 (editable)

ClusterFuzz has detected this issue as fixed in range 404631:404811.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5406262791766016

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false in ReplaceSelectionCommand.cpp
  blink::ReplaceSelectionCommand::mergeEndIfNeeded
  blink::ReplaceSelectionCommand::doApply
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=399276:400924
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=404631:404811

Minimized Testcase (1.31 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97l9LLcqByJspeztOtbBW0WuAUUBmSDRBGOh9VuJS1D0sMNDYC6e11npqcHFErd7WHDT9TWXbyvBCDGur6AgZsNNY1otqxk_BXfelcnQavP-5-Dpm2A1EY-kQjn2SZwrcWz4sMH4XQ1jk7ssg-5-ONHgL7KfQ?testcase_id=5406262791766016

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot