Unable to find actual suspect through code search and also observing no CL's under regression range, hence adding appropriate label and requesting someone from Dev team to look in to this issue.

Thanks!

eae@, just wondering do you have any inputs here?

Thank you!

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6b18d3dad1226e99cee0e92670f82a3c6b7ef11b

commit 6b18d3dad1226e99cee0e92670f82a3c6b7ef11b
Author: Morten Stenshorne <mstensho@chromium.org>
Date: Tue Oct 23 12:41:22 2018

Don't let outer multicol height confuse orphans/widows on inner multicol.

In the initial layout pass of a multicol container with auto height,
there'll be no known breaks, but we will honor the contraints of any
outer fragmentation context, and insert pagination struts if necessary.
These pagination struts need to be ignored when we calculate the height
requirements imposed by orphans and widows requirements, or we risk
making the inner multicol too tall.

Bug:  891703 
Change-Id: Ia9281508fcbba3572d653f1bbf863f045db71827
Reviewed-on: https://chromium-review.googlesource.com/c/1296492
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Commit-Queue: Emil A Eklund <eae@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#601923}
[add] https://crrev.com/6b18d3dad1226e99cee0e92670f82a3c6b7ef11b/third_party/WebKit/LayoutTests/external/wpt/css/css-multicol/multicol-nested-006.html
[modify] https://crrev.com/6b18d3dad1226e99cee0e92670f82a3c6b7ef11b/third_party/blink/renderer/core/layout/column_balancer.cc

ClusterFuzz has detected this issue as fixed in range 601922:601923.

Detailed report: https://clusterfuzz.com/testcase?key=6535518719049728

Fuzzer: puzzor
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IsFirstAfterBreak(line_top_in_flow_thread) || !line.PaginationStrut() || !IsLogi
  blink::MinimumSpaceShortageFinder::ExamineLine
  blink::ColumnBalancer::TraverseLines
  
Sanitizer: address (ASAN)

Fixed: https://clusterfuzz.com/revisions?job=linux_debug_chrome&range=601922:601923

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6535518719049728

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6535518719049728 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.