suspected cl :https://chromium.googlesource.com/chromium/src/+/4021ae18b9410d496adc92077e00672253f3876d%5E%21/third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp

kotenkov@ updated last time , tkent@ could you please look into this

The CL didn't change any behavior.
Route to Editing triage.

Lower to Pri-2 since real world usage of Outdent command is low and unusual CSS rule: 
*:only-of-type { visibility: collapse; }

startOfParagraphToMove.showTreeForThis()
BODY	000002F498503160 (editable)
	#text	000002F4985031C8 "Reproducible crash opening anekdot.ru.\n  "
	P	000002F498503218 (editable)
	#text	000002F498503280 "\n  "
	P	000002F4985032D0 (editable)
*		#text	000002F498503338 "\n   No crash == SUCCESS\n  "
		STYLE	000002F498503388 (editable)
			#text	000002F498503418 "\n   * {\n    visibility: visible;\n}\n*:only-of-type {\n    visibility: collapse;\n  "
		#text	000002F498503468 "\n  "
		SCRIPT	000002F4985034B8 (editable)
			#text	000002F498503530 "\nonload = function() {\n    document.designMode = 'on';\n    var __v_106 = document.querySelector('blockquote');\n    getSelection().collapse(__v_106, 2);\n    document.execCommand('Outdent');\n};\n  "
		#text	000002F498503580 "\n  "
	BLOCKQUOTE	000002F4985037D8 (editable)
		#text	000002F498503638 "\n   "
		TABLE	000002F498503688 (editable)
			#text	000002F498503788 "\n   "
	BR	000002F498503840 (editable)
	BLOCKQUOTE	000002F4985035D0 (editable)
		TABLE	000002F498503708 (editable)

ClusterFuzz has detected this issue as fixed in range 423391:423439.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6648590101643264

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  isStartOfParagraph(startOfParagraphToMove). #text "\n   No crash == SUCCESS\n  "
  blink::CompositeEditCommand::moveParagraph
  blink::IndentOutdentCommand::outdentParagraph
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=268656:269696
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=423391:423439

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv9781jtcOw5O5gcWqYMUg-G2YO8Zl-BKjWQToCIMfuEoNUIBmuUEjz1Hocj8UA5D9DaQtL59aDOJCo0dQNbpJH9-Ie9Gg2IzZzi5XzzXyekebvhs8ci2XtvJm9jlnPCB1KKtYFuQnfjPU_qpjTwjZCrSU8csyA?testcase_id=6648590101643264
Reproducible crash opening anekdot.ru.
  </p>
  <p>
   No crash == SUCCESS
  <style>
   * {
    visibility: visible;
}
*:only-of-type {
    visibility: collapse;
  </style>
  <script>
onload = function() {
    document.designMode = 'on';
    var __v_106 = document.querySelector('blockquote');
    getSelection().collapse(__v_106, 2);
    document.execCommand('Outdent');
};
  </script>
  <blockquote>
   <table>
   <table>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot