The result is a list of CLs that change the crashed files.

Author: yoichio
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/24ea6629ef3f75e2dc01d438729d18918a80f80b
Time: Wed Jul 13 05:03:04 2016
Lines 812 of file DeleteSelectionCommand.cpp which potentially caused crash are changed in this cl (frame #4, "blink::DeleteSelectionCommand::removeRedundantBlocks").

Files Node.cpp, CompositeEditCommand.cpp are changed in this cl (and is part of stack frame #1, "blink::hasEditableStyle"; frame #2, "hasEditableStyle"; frame #3, "blink::rootEditableElement")
Minimum distance from crash line to modified line: 0. (file: DeleteSelectionCommand.cpp, crashed on: 812, modified: 812).

Suspected Project: chromium
Suspected Component: Blink>DOM
================================
yoichio@: Could you please look into this issue if it is related to your change, else please help us in assigning it to the right owner.

Thanks!

DCHECK in VisiblePosition ctor:
DCHECK(positionWithAffinity.position().isConnected()) << positionWithAffinity;

positionWithAffinity = TABLE@afterAnchor/TextAffinity::Downstream

which comes from
    VisiblePosition startOfParagraphToMove = createVisiblePosition(m_downstreamEnd);
in DeleteSelectionCommand::mergeParagraphs()

DOM tree before "cut" command:

m_endingSelection.showTreeForThis()
BODY	00000331C5083160
	DIV	00000331C50831C8 ID="div" (editable) (focused)
		#text	00000331C5083230 "\n   "
E		TABLE	00000331C5083280 (editable)
			#text	00000331C5083368 "\n    "
			TBODY	00000331C5083300 (editable)
				TR	00000331C50833B8 (editable)
					TD	00000331C5083420 (editable)
						OL	00000331C5083710 (editable)
							LI	00000331C5083788 (editable)
S								BR	00000331C50837F0 (editable)
							LI	00000331C5083858 (editable)
								#text	00000331C5083A50 "bar"
						#text	00000331C5083488 "\n       "
						#text	00000331C5083540 "\n       "

FrameSelection::base: BeforeAnchor, BR
FrameSeleciton::extent: AfterAnchor, TABLE

ClusterFuzz has detected this issue as fixed in range 417253:417272.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6708382178476032

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  blink::hasEditableStyle
  blink::rootEditableElement
  blink::DeleteSelectionCommand::removeRedundantBlocks
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_content_shell&range=404947:405067
Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_content_shell&range=417253:417272

Minimized Testcase (0.37 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94rpn555860UgExWkvHDUXGaEepzCay5Be2X3vY6vG4f-jE3nLYl9r8RUauhGl3mPXrLtpT_MacredOwFSFaqNHIjZwkKf-nJ8snkKu1HxMT0RWOH8Xo8WP6qAigeNwZ4k2si1MHDiqWabUkzgSYWn4rrMSRg?testcase_id=6708382178476032
  <div contenteditable="true" id="div">
   <table>
    <td>
       <br/>
       <span id="span">
        bar
  <script>
sel = window.getSelection();
sel.setBaseAndExtent(div, 0, span, span.childNodes.length);
document.execCommand("InsertOrderedList");
__v_246 = window.getSelection();
    __v_246.modify("extend", "forward", "line");
    


    document.execCommand("Cut");
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot