Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5563205416124416

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  document().body() != refChild in CompositeEditCommand.cpp
  blink::CompositeEditCommand::insertNodeBefore
  blink::CompositeEditCommand::insertNodeAfter
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=369991:370003

Minimized Testcase (0.38 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95nrW3imvWz3pEQMPM16L72pA6anAF7OTHbeoHpXmiI-GMHH4N_FqTtFXo10tB8s_l07EWPE07Qqp1q4XkjBhurNQFYZfpmJEf9VJHrFheYePQFrptjdELNRLA1nRHft9AUkOOd-DsTwtDIL8WOJVz8atrNbA?testcase_id=5563205416124416
<style>
    p.red { background-color: red;</style>
        testRunner.dumpAsTextWithPixelResults();
  <br/>
  <style>
   * { display: -webkit-inline-box; }
.CLASS11 { float: right;</style>
  <script>
window.onload = function () {
    document.designMode = 'on';
    document.execCommand('SelectAll')
    document.execCommand('Indent');
};
  </script>
  <div class="CLASS11">
  </div>
   bbb


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.