Predator did not find any possible suspects.
Assigning to the concern owner from CL --
https://chromium.googlesource.com/chromium/src/+log/2d184d931166e89d8163c78f945fa168afd080d2..5d6f36b35b6bf8bd4c31f861e5f46875b46fb82d?pretty=fuller

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/4da5a6bc55b8e3909b98f3e0f23d7c5d0cb9ecb8

@sigbjornf -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

When seeing that CHECK() failure, it's worth taking into account what's a bit further up the stack. The CHECK() is catching an outsized allocation that we cannot support, with the CL referred to switching to a CHECK() instead of an older RELEASE_ASSERT(), so not changing failure condition.

The testcase here is the same as for  issue 610272  and  issue 627805 , the fuzzer generating text nodes too large to handle, triggering failure here&there when later touched. Repro case:

<script>
var styleElement = document.createElement('style');
var str="z";
for (var i = 0; i < 16; i++) {
    str += str;
}
for (var i = 0; i < 1+(1<<16); i++){
    var txt = document.createTextNode(str);
    styleElement.appendChild(txt);
}
console.log(styleElement.innerText.length);
</script>

Closing as WontFix per https://bugs.chromium.org/p/chromium/issues/detail?id=627805#c3

 Issue 691276  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 471041:471079.

Detailed report: https://clusterfuzz.com/testcase?key=6207350714400768

Fuzzer: inferno_twister
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: CHECK failure
Crash Address: 
Crash State:
  count <= maxElementCountInBackingStore<T>() in PartitionAllocator.h
  void WTF::Vector<unsigned char, 16ul, WTF::PartitionAllocator>::append<unsigned 
  blink::Node::textContent
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=447465:447478
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=471041:471079

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6207350714400768


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.