ClusterFuzz has detected this issue as fixed in range 384695:385240.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5930257198088192

Fuzzer: attekett_dom_fuzzer
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  RepresentationChangerError: node #612:NumberSubtract of kRepFloat64 (Range(-NUMB
  <unknown>
  v8::base::OS::Abort
  
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=384695:385240

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96TZOds6cxS8gFbqLT3DiUpK2LB_igUNCeavBVDcy-PJUXaZUbYnkTTsrUGjrBsXMAIXFNglb6-8qLrvHxihHCaG9QeOSDpifts97WJWd-d9H5BPKNWjBCQTXKxewOgtfqmGBIGPHZhl-39FQLEqxE4lruZSw


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot