Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6610635090821120

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  isStartOfParagraph(startOfParagraphToMove). null/TextAffinity::Downstream in Com
  blink::CompositeEditCommand::moveParagraph
  blink::InsertListCommand::moveParagraphOverPositionIntoEmptyListItem
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=369978:369981

Minimized Testcase (0.29 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95z7helycJdBP67y0iGnXpURFCbCKinV8vc4Dox1wogZTwgOof4STxrJGGUSy3eRe6A3ueDYyPCILqBH-5lsZgjQ55CMjJy-uW2EKt_IvfjF9_EUXCjlh0Ti7tplF7e3Cdh_vYBorHTaV5pETA7YbOYCV03gAiG48i4JQEuCMJMvVjZh39wFBQYN917eGb_UauB0WBlswXGbmBZ8SLTYdDfSx8goQYG4WvT8SuAqC7OPb3_jJKflePMHopcMIDhSrqffHi8ZvZdNpQVaSGy_n3FbK6TMoaOUNCgYbp6IzeFecVSAPvobqEpZf2rAJ3TYJzGddIAEZweo1NL3rnEyvag-6wlqrTc1prWBQvV-e2CEMNtqLo?testcase_id=6610635090821120
<style>
br {
visibility:hidden;
</style>
<script>
  var af = [], i = 0;
  function main(){af[i++ % af.length]()}
af.push(function (){
  document.execCommand("SelectAll");  document.designMode="on";  })
af.push(function (){
  document.execCommand("InsertOrderedList");  })
  setInterval(main);
</script>


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.