Suspecting:

Author: yoichio
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/d65d16a817f1f0522c93bc2471d1a62e37285f3e
Time: Fri Jul 22 03:41:12 2016
Lines 604 of file Node.cpp which potentially caused crash are changed in this cl (frame #2, "content_shell!blink::hasEditableStyle+0x6a").

Lines 324 of file CompositeEditCommand.cpp which potentially caused crash are changed in this cl (frame #3, "content_shell!blink::CompositeEditCommand::insertNodeBefore+0x33").

Files EditorCommand.cpp, ReplaceSelectionCommand.cpp are changed in this cl (and is part of stack frame #6, "content_shell!blink::executeInsertFragment+0x20 ")
Minimum distance from crash line to modified line: 0. (file: Node.cpp, crashed on: 604, modified: 604).

@yoichio: Could you please look into this issue.

Thank you.

It seems DIV inside SPAN causes insertHTML to crash.

DOM tree at DCHECK:

m_endingSelection.showTreeForThis()
BODY	0000023809683170
	DIV	00000238096831D8 (editable) (focused)
		#text	0000023809683240 "\n   "
		B	0000023809683310 ID="test" (editable)
			#text	00000238096837E0 "\n             a"
			DIV	00000238096835A0 (editable)
				#text	0000023809683608 "foo"
			DIV	00000238096836C0 (editable)
				#text	0000023809683728 "bar"
SE			#text	00000238096833C8 "ll 79 news articles\n  "
			SCRIPT	0000023809683418 (editable)
				#text	0000023809683490 "... script ..."
		TABLE	0000023809683290 (editable)
			#text	0000023809683378 "\n          

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5217676691767296

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  blink::hasEditableStyle
  blink::hasEditableStyle
  blink::CompositeEditCommand::insertNodeBefore
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=406399:406472

Minimized Testcase (0.36 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95rQUz0ojWOvQ6uLDTFdrchzi2-49QWsBYH5UticgxNgFKliibgtTgToK2gYoYU8jDCU23VKULE5ZTtRh36GTTY3r5DFUrLm9oQ7e1elV8sbW6ZYWRLPVYUXrq5wA3Rm-lhVBBLIXYvgUbhGhL8mzLxpPzu-Q?testcase_id=5217676691767296

Filer: rnimmagadda

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

 Issue 631991  has been merged into this issue.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4576607155257344

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  blink::hasEditableLevel
  blink::hasEditableStyle
  blink::CompositeEditCommand::insertNodeBefore
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=406399:406472

Minimized Testcase (0.36 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97AJ8Db3AJXjD3jgrdz-Whq-z91Dqbk_QguB9Zf2OWQ0khn3Bhd4gseFXyNn2Eb_TBIRR6Z-mDkAHk4FsMOIkCzUsjVth8051Wa1Gz9swyc-449M9LkTY7FAPWL6PNa7t7XHBhL8EwdotXsNNgUtNSA-62KpQ?testcase_id=4576607155257344

Filer: rnimmagadda

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this issue as fixed in range 409147:409160.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4576607155257344

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  blink::hasEditableLevel
  blink::hasEditableStyle
  blink::CompositeEditCommand::insertNodeBefore
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=406399:406472
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=409147:409160

Minimized Testcase (0.36 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97AJ8Db3AJXjD3jgrdz-Whq-z91Dqbk_QguB9Zf2OWQ0khn3Bhd4gseFXyNn2Eb_TBIRR6Z-mDkAHk4FsMOIkCzUsjVth8051Wa1Gz9swyc-449M9LkTY7FAPWL6PNa7t7XHBhL8EwdotXsNNgUtNSA-62KpQ?testcase_id=4576607155257344

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 409147:409160.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5217676691767296

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  blink::hasEditableStyle
  blink::hasEditableStyle
  blink::CompositeEditCommand::insertNodeBefore
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=406399:406472
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=409147:409160

Minimized Testcase (0.36 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95rQUz0ojWOvQ6uLDTFdrchzi2-49QWsBYH5UticgxNgFKliibgtTgToK2gYoYU8jDCU23VKULE5ZTtRh36GTTY3r5DFUrLm9oQ7e1elV8sbW6ZYWRLPVYUXrq5wA3Rm-lhVBBLIXYvgUbhGhL8mzLxpPzu-Q?testcase_id=5217676691767296

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Changing the status to Fixed as per ClusterFuzz has detected the issue as fixed in the regressed range in Comment# 7.
Please undo if that is not the case.
Thank You.