Predator and CL could not provide any possible suspects.
Using Code Search for the file, "FrameSelection.cpp" assigning to the concern owner.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/48496eefc2ca8dc673daf4eff0d45a0822489ebf

@yosin -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Lower to Pri-3, because real-world usage of window.find() is low.

This issue and  issue 740401  are occurred by same sample and same stack traces but different platforms.

ClusterFuzz has detected this issue as fixed in range 485213:485233.

Detailed report: https://clusterfuzz.com/testcase?key=6149758866685952

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  blink::ComputeTextRect
  blink::FrameSelection::RevealSelection
  blink::Editor::FindString
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=481254:481399
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=485213:485233

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6149758866685952


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.