Predator and CL did not provide any possible suspects.
Using Code Search for the file, "fx_extension.cpp" assigning to the concern owner.
Suspecting Commit#
https://pdfium.googlesource.com/pdfium.git/+/cfb1944e245e20fe2ce0e94feebc06526db34fa1

@dsinclair -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/b83d870b007f25b18e6b7a4ce2a417420d4dcb89

commit b83d870b007f25b18e6b7a4ce2a417420d4dcb89
Author: Nicolas Pena <npm@chromium.org>
Date: Fri Jun 09 22:18:01 2017

Fix types for FT_ULong chars in fpdfedittext

FXFT_Get_First(Next)_Char can return large unsigned values. This CL avoids
integer overflow and adds some missing checks regarding the ranges of the
values returned by those methods.

Bug:  chromium:727086 
Change-Id: Ice7bbb3759e384b7174680a82a2a9380c3611382
Reviewed-on: https://pdfium-review.googlesource.com/6436
Commit-Queue: Nicolás Peña <npm@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

[modify] https://crrev.com/b83d870b007f25b18e6b7a4ce2a417420d4dcb89/fpdfsdk/fpdfedittext.cpp

ClusterFuzz has detected this issue as fixed in range 478441:478496.

Detailed report: https://clusterfuzz.com/testcase?key=6266654681202688

Fuzzer: libFuzzer_pdf_font_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  unicode <= ADDRESS || (unicode > ADDRESS && unicode <= ADDRESS)
  FXSYS_ToUTF16BE
  AddUnicode
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=472896:472939
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=478441:478496

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6266654681202688


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6266654681202688 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.