Predator and CL did not provide any possible suspects.
Using Code Search for th file, "PartitionAllocator.h" assigning to the concern owner.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/4da5a6bc55b8e3909b98f3e0f23d7c5d0cb9ecb8

@sigbjornf -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

The CL in #1 changed a RELEASE_ASSERT() to a CHECK_LE(), so not really involved and the cause here -- vector overallocation happens a bit further up the stack.

Related to  issue 683553 .

ClusterFuzz has detected this issue as fixed in range 453200:453210.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5243192497930240

Fuzzer: ifratric-browserfuzzer-v3
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: CHECK failure
Crash Address: 
Crash State:
  count <= maxElementCountInBackingStore<T>() in PartitionAllocator.h
  void WTF::Vector<blink::LayoutRect, 0ul, WTF::PartitionAllocator>::appendSlowCas
  blink::LayoutMultiColumnSet::computeColumnRuleBounds
  
Sanitizer: address (ASAN)

Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=453200:453210

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv974KGrffgZWyAeGceNvkBCgfHlGKHPsFgInzLUhhcyicIq_1m8jjs9cJvCXD0DXiI4mARSWMfOKkoJOmM44ppZXcknnfmsgOKh5sJBE-f6qpO6XGkn5blolLzaGaYek-SePVc2Y1NuWnlRX5b3dTHZtPBI7A8fafQcj3AyiVggK41KzX90CbRMKEiWOZny47xvheSPay_cuj7TZLb9b4p2Ch9Vg7BottqDuneLKosuMbF6bOywm4e28sU9GDcioaypwIkZ9T-RXLl_xF9ZS-A5wdzjOeeiZcF1fyQUX2tolQVrCPSSGE7t27k4kC3YOnrIJkzhe8IWoHV9aPjx5fsb2cv7_atzMs88dAn2KK25qWgtn2OU?testcase_id=5243192497930240


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.