Predator did not provide any possible suspects.
Assigning to the concern owner from CL --
https://chromium.googlesource.com/chromium/src/+log/74946c37525c8b29f9b7b117c2d092a31b467b4d..bd0fcfc50787bed5d42f1c8fab247234c1a6a20e?pretty=fuller

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/ea39d1dc3b628c867bb78baddbf44e2f017e0456

@eae -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Intentional crash for corrupted content. Ideally we should detect this before we get into a bad state but given lack of reports in the wild and the hoops required to get into a bad state it isn't a priority at the moment.

 Issue 724865  has been merged into this issue.

there is a repro for this in  issue 724865 

ClusterFuzz has detected this issue as fixed in range 488064:488102.

Detailed report: https://clusterfuzz.com/testcase?key=5629767765458944

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_chrome_mp
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  list_node in LayoutListItem.cpp
  blink::LayoutListItem::UpdateListMarkerNumbers
  blink::LayoutObjectChildList::RemoveChildNode
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=467230:467252
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=488064:488102

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5629767765458944


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5629767765458944 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

ClusterFuzz testcase 5874972991160320 is still reproducing on tip-of-tree build (trunk).

Please re-test your fix against this testcase and if the fix was incorrect or incomplete, please re-open the bug. Otherwise, ignore this notification and add ClusterFuzz-Wrong label.