Predator could not provide any possible suspects.
Assigning to concern owner from CL --
https://chromium.googlesource.com/chromium/src/+log/4bd9033d09cb618c71d5714222ba1c9029d168fa..6038027e89747913716cf298c822f70f67444812?pretty=fuller&n=10000

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/b71ac55bffca1c376d6ed4e540194436daccfbd1

@mstensho -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

The suspected commit looks like the culprit, indeed.

Deleted: tc.html 316 bytes

tc.html 316 bytes View Download

 Issue 759472  has been merged into this issue.

 Issue 759315  has been merged into this issue.

The bad commit has been reverted:

https://chromium-review.googlesource.com/632057

 Issue 759271  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 497777:497807.

Detailed report: https://clusterfuzz.com/testcase?key=5439835585380352

Fuzzer: bj_broddelwerk
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: Breakpoint
Crash Address: 0xf3616240
Crash State:
  blink::LayoutBox::SetSpannerPlaceholder
  blink::LayoutMultiColumnFlowThread::CreateAndInsertSpannerPlaceholder
  blink::LayoutMultiColumnFlowThread::FlowThreadDescendantStyleDidChange
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=497433:497463
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=497777:497807

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5439835585380352

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5222949601935360 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.