Detailed report: https://clusterfuzz.com/testcase?key=5549805331021824

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: UNKNOWN READ
Crash Address: 0x00000000000d
Crash State:
  blink::RootInlineBox::closestLeafChildForLogicalLeftPosition
  blink::nextLinePosition
  blink::SelectionModifier::modifyMovingForward
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=434178:434216

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv97T8MpQAOckoQbsRmPRn-GCfvT0vAFk4Lufofup9FjaUjvtqUX2i5kqWxcapAcuXNlrxZmZ9MirnIh_EqckxpPxkQ1U_MrH7dTLGIwC4ej-671GMMd3vgca5vh5J0D2Snv16FlZczXKWkkW-LL0pyLpOn-F9RTezwiH_8k1prah-k12Krp_yndawYyzkQXKENx9wRaFQv-UjkRNtw52Uoo0XWo2Z2XSuHLVq7Iytaq1kd7W6Pt49kEj6MhD7N2UlxUr03gfRjVukytEfBCQ0NYzNbtKnhR6jat6Ijes7gf7Wdfz9l7uSpyhuQOq-CBdOUu4GHw_BcK3GBR5E4ZyH6p4wDIqMM4K16rsEodmxBl86JKQRfpAHDQN3QcwuvdngswQ52anHeG2qzTaz-MSIzZi9fWOdw?testcase_id=5549805331021824


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.