Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5779519978078208

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false in ReplaceSelectionCommand.cpp
  blink::ReplaceSelectionCommand::mergeEndIfNeeded
  blink::ReplaceSelectionCommand::doApply
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=399276:400924

Minimized Testcase (0.34 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96xkbTn05l_-wNu76-VDK4yaBfHEIWxCWnAJw8-5J5Bfbt9_4XKKOh0jUBVURQC78OENxDBF-84AvgcKAjnqy8N-F0EumFWTeQANbyY3UijhOopamYEshUSUQ8_VQfYdZd-oQkEj-CaaQXi8w0NKcLXWrRbsw?testcase_id=5779519978078208
<style>
   div {
	background: blue;
	display: flex;
}
span {
	background: white;
  </style>
  <div contenteditable="true" id="div">
   Everything n this editable region should be in one paragraph.
  <script>
text = div.firstChild;
sel = window.getSelection();
sel.collapse(text);
document.execCommand("InsertHTML", false, "<div>i</div>")
</script>


Filer: mmohammad

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.