Predator and CL could not provide any possible suspects.
Using Code Search for the file, "LayoutObject.cpp" assigning to concern owner.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/a1b7f563e44e75fcb1c1534b2e0fe725f60e902c

@xiaochengh -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Marking as WontFix because the test case tries to produce infinitely deep DOM tree.

ClusterFuzz has detected this issue as fixed in range 496076:496126.

Detailed report: https://clusterfuzz.com/testcase?key=4749870463451136

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: Stack-overflow
Crash Address: 0x7fff5a81bfe0
Crash State:
  blink::LayoutObject::ContainingBlock
  blink::LayoutBlock::ComputeBlockPreferredLogicalWidths
  blink::LayoutBlock::ComputeIntrinsicLogicalWidths
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=482663:482701
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_chrome&range=496076:496126

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4749870463451136

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.