This is similar to  issue 697610 . yosin@, could you please confirm and duplicate it.
Thank you

Looks like firstLeafChild() is null. We should probably add a check to see if either the first or last leaf is null and exit early.

ClusterFuzz has detected this issue as fixed in range 455091:455394.

Detailed report: https://clusterfuzz.com/testcase?key=5465946161676288

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000000d
Crash State:
  y
  logicalLeft
  blink::RootInlineBox::closestLeafChildForLogicalLeftPosition
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=387407:387541
Fixed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=455091:455394

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv94fxUYXjs78F5r0AaInV1MjYP7SuwjaaXF6qugTSHkB-o1iyjLiiNoDJeQBGuR_QvENVrVb88CknxvvZC6AKPt-nXRJgbbLOOhWGwNXJfY-ZLvWOnbD57B9950pM1-oLyrZ8bhKyOJsvJarXrfC8UM0C1dUKh5dyBGvH9qaj3Pnccn_UdhbXHquKdGkMEblMMJVFmLPksmLVqa6RMgIEN3C3dq0_NUDiEcXo3u98GB6aOX7rL6isQ-nf9huMcjg1ry3LKQ2e5r_VL-Qg7dRRPWxMUKhzyFGAkngdwJBfMYO3WRZMpsRF21sN_vLI4h6JckgtqfX6EpXcxUQ-KnOgLSkRYk4ojnMT1hmFuijbFbSnymQy0o?testcase_id=5465946161676288


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5465946161676288 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

 Issue 700623  has been merged into this issue.