Through code search on file RangeBoundaryPoint.h, yosin@ touched the code "Range objects". could you please take a look and reassign if it is not related your changes.

https://chromium.googlesource.com/chromium/src/+/6d90de9c8429ea28e578ff42ed6e2d35d963722b

Thank you

ClusterFuzz has detected this issue as fixed in range 413090:413122.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6403792759422976

Fuzzer: bj_broddelwerk
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  m_offsetInContainer > 0 in RangeBoundaryPoint.h
  blink::RangeBoundaryPoint::childBeforeWillBeRemoved
  blink::boundaryNodeWillBeRemoved
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=397991:398001
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=413090:413122

Minimized Testcase (2.40 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94HrM09Z-KbhtUYo5VGPHWEIIcrkh4m6xImU9YvG-KRQikX2fx2cUx1ua73Z_IUvNF7cmQoQmFCyqLqceI0rua1rEE2XYjJMNrCeVbPc8ZQ8zBWDqT2RG_EoUzk8yqZjx1Md6-L4yJ31gPvRG8g-Z4-yOesIQ?testcase_id=6403792759422976

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot