Through code search on file TextCheckingHelper.cpp, suspected CL is 
https://chromium.googlesource.com/chromium/src/+/3325b1d139dd5ce8101ed992c3038b5ddcca5513%5E%21/third_party/WebKit/Source/core/editing/spellcheck/TextCheckingHelper.cpp

yosin@, could you please take a look and please help us to find correct owner if it is not related your changes.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Lower to Pri-2, since it is caused by unsual HTML, RUBY contains INOUT, SELECT

BODY
	TABLE class="CLASS9 CLASS7"
		#text "\n"
		CAPTION
			#text "\n"
			RUBY
				#text "\n"
				RB
					#text "\n"
				SMALL (editable)
*					#text "abc"
					INPUT (editable)
						#shadow-root
							DIV id="inner-editor" (editable)
					#text "def"
				SELECT (editable) (focused)
					#shadow-root
						CONTENT
					#text "ghijklmno"
				RTC
					#text "\n"
					RT
						#text "\n"

ClusterFuzz has detected this issue as fixed in range 456626:457730.

Detailed report: https://clusterfuzz.com/testcase?key=5878440576417792

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  paragraphEnd.isNotNull(). #text "7JJJJ********Q:%\"\"FX?OWWWWWWWWWi"@offsetInAnc
  blink::expandToParagraphBoundary
  blink::TextCheckingParagraph::paragraphRange
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_debug_content_shell_drt&range=417866:417868
Fixed: https://clusterfuzz.com/revisions?job=linux_debug_content_shell_drt&range=456626:457730

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv940YW-cR52QsliOBSTh0VPsuZPvX1aemm-UKb_ho7KBXfzrnVb_g-H-eiMZNEQYsiajMLqgc9vtz3q7EipTKuU8ljPmdjlVEY9O1LR5t5_1NIOQT-DGazw5EFWF_SgsJirQcElf7zi3NxZhBpIvHcfkbj4h6IlP42cvBiXZhUkbWDo_nZWe-DkAF_aSYu3zcV0FDrr6Va9oJnkAzodJfW7Q5DVAFVR6T3Grz1vAZsGXjrGhtWAwOo-ANbCndQ0xeynwM7CuJIjUivvGBFqpxTF--uGT0HmBuMok1LAzPwtLx7AjpAnqjdVEF-iVF5OKKD4ffGhKa6pB50cvV_a7DX4jK07l8_6wRA3Tx-MCm3y0AxuJ94nIrJN_C0P9oEcc-FOvvwKGAF6AfFI_WsFmnVOTU7Hg6w?testcase_id=5878440576417792


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5878440576417792 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.