Predator could not provide any possible suspects.

From the below CL observing some changes related to 'TextIterator.cpp' , hence suspecting the same
https://chromium.googlesource.com/chromium/src/+log/1c4c5143ea34b393cdeba7aa8870cf2e4af14f53..71baf2eb8fd8e1631c2312e8baeb57ad55b2ab14?pretty=fuller&n=10000

Suspect CL: https://chromium.googlesource.com/chromium/src/+/632b145c0e44fc890662f41a8638d7bcb4a203bf

wangxianzhu@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!

The CL is just a rename.

Let's go through Blink>Layout triage process.

Out-of-bound indexes are passed to blink::WebInputMethodControllerImpl::SetComposition().

I put up a CL for fixing this:
https://chromium-review.googlesource.com/c/chromium/src/+/993698

but xiaochengh@, yosin@, and I were unable to agree upon if this is the correct fix or not

ClusterFuzz has detected this issue as fixed in range 549059:549062.

Detailed report: https://clusterfuzz.com/testcase?key=5664930710945792

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_ubsan_vptr_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  start <= end (#text "4-NUMBER"@offsetInAnchor[1] vs. #text "4-NUMBER"@offsetInAn
  blink::TextIteratorAlgorithm<>::TextIteratorAlgorithm
  blink::DocumentMarkerController::AddMarkerInternal
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=478364:478645
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=549059:549062

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5664930710945792

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5664930710945792 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.