Predator and CL did not provide any possible CL.
Using Code Search for the file, "LayoutDeprecatedFlexibleBox.cpp" assigning to the concern owner.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/eab82c830edc973964782a440d878ed077e6a5be

@robhogan -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/16b1ddb99276778202afb33e762c7d422118f374

commit 16b1ddb99276778202afb33e762c7d422118f374
Author: robhogan <robhogan@gmail.com>
Date: Sat Mar 18 21:58:17 2017

-webkit-box-ordinal-group cannot exceed the keyspace for a HashSet

HashTables have the capacity of a 32bit int so anything greater than or equal
std::numeric_limits<unsigned>::max() will just overflow to -1 or reference an
unavailable bucket, so cap it to max() - 1.

BUG= 700622 

Review-Url: https://codereview.chromium.org/2748993003
Cr-Commit-Position: refs/heads/master@{#457981}

[add] https://crrev.com/16b1ddb99276778202afb33e762c7d422118f374/third_party/WebKit/LayoutTests/fast/deprecated-flexbox/ordinal-group-max-value-expected.txt
[add] https://crrev.com/16b1ddb99276778202afb33e762c7d422118f374/third_party/WebKit/LayoutTests/fast/deprecated-flexbox/ordinal-group-max-value.html
[modify] https://crrev.com/16b1ddb99276778202afb33e762c7d422118f374/third_party/WebKit/Source/core/style/ComputedStyle.h

ClusterFuzz has detected this issue as fixed in range 457980:457983.

Detailed report: https://clusterfuzz.com/testcase?key=5331199305449472

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: Floating-point-exception
Crash Address: 
Crash State:
  blink::LayoutDeprecatedFlexibleBox::layoutHorizontalBox
  blink::LayoutDeprecatedFlexibleBox::layoutBlock
  blink::LayoutBlock::layout
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=452830:452941
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=457980:457983

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96qrOAPuTAZqeQew2j6oTWjkpabge7Vbui6ERynw6LRHg60yPwFhg-yH_FUui_aXVOjmG2JFqwfDhNt7rm42ZHm4g2ws5zZYfKA65GeH7TDjRLGWxmZrX6FdHeLfQ7_s8m_mcIAkd6oayyISvuke3gbgaWjBDMhLzFotDr_hFj_S8GZci00z-S19rFV_fiY2M22AzMxt3Sn4vOMFkpg9ILxYaFm2lJ3p5VFnUOLpwRTOtiXL6IDvs41lTAOmlIEbmR4Hc9l5NZRuYe6TsLi5lOGCzWCKw-ynIGJIix8dGXVlm_XYHAbFulTYOT54zxreReXd28IBJmXC2oljTYMuy7JyrICPrbGXPdu6Gjv2YMrnaUloXk?testcase_id=5331199305449472


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5331199305449472 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.