Find it did not provide any possible suspects.
Assigning to the concern owner from CL --
https://chromium.googlesource.com/chromium/src/+log/b65ab0c7ef82e115a49e79ab0d413d2de7df2f11..b5c9bcd8091d35691e61a939eb2aa8201baf57c8?pretty=fuller

@mkwst -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

ClusterFuzz has detected this issue as fixed in range 454873:455052.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5025404739125248

Fuzzer: inferno_twister
Job Type: linux_ubsan_vptr_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  lifecycle().stateAllowsTreeMutations() in Document.cpp
  blink::Document::updateStyleAndLayoutTree
  blink::Document::scrollingElement
  
Sanitizer: undefined (UBSAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=443258:443393
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=454873:455052

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96wQfFJXibtxWgTKgB_Br2o1aGeVz4vU87JqzB-xpsIBULA6N9pIHIygmLuMCbcx8pxODEXp2Cb47DffFTdfhmE4eZbrjDErGq9dqp2SVUkngV3VnSobl0wfC3WBTMaBp2XdDZvvB5SGQasdyes1A_M9eOu8uCQpmYtmVmxrZmme8XblXMc8cgRkUW0Ejedh7fV4TPrRHVHOoo3zcuNSKzH5UG1CbCwjw75vikuhDjPlazxHsYnhgVdokP4HX6hetziZbUuj-7kAb8-d2ZkaVAZhxxR3VaQKefx7WTPBEbR99VLlr1hCWs6KWG3-M4LXE3llXjrrHzcVZpof0nFKEHL873izVoxXT1cprRwkBK2sYpT5Pzywbd-AU5Dy-pWcWVg75KvWEualAO696HRy5clfbLCqg?testcase_id=5025404739125248


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5025404739125248 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.