Through code search on file EditingUtilities.cpp, suspected CL is 
https://chromium.googlesource.com/chromium/src/+/01c0fa0405b15a4492c7ae131c670b733fb9d8f5%5E%21/third_party/WebKit/Source/core/editing/EditingUtilities.cpp

Is it another case that <video> mutates DOM tree during |updateStyleAndLayout()|?

If so, guess we should triage to style team?

It is LayoutTextTrack::layout() that makes the layout tree still dirty after |updateStyleAndLayout()| finishes.

Triaging to media team, and hope we could get rid of the |DeprecatedScheduleStyleRecalcDuringLayout| there.

ClusterFuzz has detected this issue as fixed in range 420571:420810.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6214828790382592

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !range.document().needsLayoutTreeUpdate() in EditingUtilities.cpp
  blink::normalizeRangeAlgorithm<>
  blink::normalizeRange
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=417243:417253
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=420571:420810

Minimized Testcase (0.47 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97OGRpXxd-z7AP4Mp0WGDbmzoE60CC5sbrWftHk28eBr1-bEgOesmbOf8V_NvWS6C3Qx0H39QHZnUrzjaKkJiaLb5XV474x8AkUiLQLWnOV9b_T3VymXtbkOKxO1-rt4OIGNJ77vBqV7IJ46zuVNPMTOMz45Q?testcase_id=6214828790382592
<b id="test">
    Sed dictum erat sit amet pharetra pretium.
  <script>
            var __v_0 = document.getElementById('test').firstChild;
            var __v_1 = document.createRange();
            __v_1.setEnd(__v_0, __v_0.length - 5);
            window.getSelection().addRange(__v_1);
</script>
    <video autoplay=""<source src="../../../media/white.webm" type="video/webm">
     <track>
  <script>
document.getElementsByTagName('track')[0].track.mode = 'showing';
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot