Predator and CL could not provide any possible suspects.

Using Code Search for the file, "editor_command.cc" suspecting the below Cl might have caused this issue

Suspect CL: https://chromium.googlesource.com/chromium/src/+/48a953f5401b8941f9f4bf2922ca6db442c9749d

Since author is not a chromium member, assigning it to the reviewer.

yosin@ -- Could you please look into this issue.

Thanks!

In review: http://crrev.com/c/1143112

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/95b78f4d85269077c800ce7d81f0168a0f738bcb

commit 95b78f4d85269077c800ce7d81f0168a0f738bcb
Author: Yoshifumi Inoue <yosin@chromium.org>
Date: Fri Jul 20 03:02:26 2018

Get rid of redundant NOTREACHED() in CompositeEditCommand::Apply()

This patch get rid of redundant |NOTREACHED()| from |CompositeEditCommand::
Apply()| since we can apply any commend to plaintext-only content editable.

Bug:  863708 
Change-Id: Id3e7377d88ffc16f0a8f32f13002de01e3184b67
Reviewed-on: https://chromium-review.googlesource.com/1143112
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#576764}
[modify] https://crrev.com/95b78f4d85269077c800ce7d81f0168a0f738bcb/third_party/blink/renderer/core/editing/commands/composite_edit_command.cc

ClusterFuzz has detected this issue as fixed in range 576763:576765.

Detailed report: https://clusterfuzz.com/testcase?key=4755684022026240

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false. Not supported input type on plain-text only element:37 in composite_edit_
  blink::CompositeEditCommand::Apply
  blink::ExecuteRemoveFormat
  
Sanitizer: address (ASAN)

Fixed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=576763:576765

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4755684022026240

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4755684022026240 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.