From findit tool:

Author: tkent@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/4b55691123dd8bada5027a035891967383f01f5d
Time: Tue Sep 15 04:21:31 2015
The CL last changed line 753 of file InputType.cpp, which is stack frame 0.

Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4923981237059584

Fuzzer: inferno_twister
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  alignedMaximum <= stepRange.maximum()
  blink::InputType::applyStep
  blink::InputType::stepUp
  

Minimized Testcase (7.40 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94fexIJ-h8KGQuQK0o6wbk9rJH65xsz4TrvQ2srbsSBbwR2J_F3GD5sVWRE5k6Kg72tNez0PJLw8RlxTfoovg8C3ejXibW0ioSx9jPrba_QqZ1lo-jF2_gwrli7woArgkswLNTOa4qIa6FOuTUEpXiIEj-UjA

Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ee4915d796448f4024de2c943a52b007021ead03

commit ee4915d796448f4024de2c943a52b007021ead03
Author: tkent <tkent@chromium.org>
Date: Mon Jun 13 21:59:52 2016

Fix an assertion failure in InputType::applyStep()

If stepBase is extremely larger than step or maximum, the old code produced
alignedMaximum larger than maximum().  This CL fixes it.

- The core logic is moved to StepRange class to improve testability
- Move the stream printer for Decimal because it is used in DCHECK_LE().

BUG= 617809 

Review-Url: https://codereview.chromium.org/2048943002
Cr-Commit-Position: refs/heads/master@{#399563}

[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/core/html/forms/InputType.cpp
[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/core/html/forms/StepRange.cpp
[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/core/html/forms/StepRange.h
[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/core/html/forms/StepRangeTest.cpp
[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/platform/Decimal.cpp
[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/platform/Decimal.h
[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/platform/DecimalTest.cpp

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ee4915d796448f4024de2c943a52b007021ead03

commit ee4915d796448f4024de2c943a52b007021ead03
Author: tkent <tkent@chromium.org>
Date: Mon Jun 13 21:59:52 2016

Fix an assertion failure in InputType::applyStep()

If stepBase is extremely larger than step or maximum, the old code produced
alignedMaximum larger than maximum().  This CL fixes it.

- The core logic is moved to StepRange class to improve testability
- Move the stream printer for Decimal because it is used in DCHECK_LE().

BUG= 617809 

Review-Url: https://codereview.chromium.org/2048943002
Cr-Commit-Position: refs/heads/master@{#399563}

[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/core/html/forms/InputType.cpp
[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/core/html/forms/StepRange.cpp
[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/core/html/forms/StepRange.h
[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/core/html/forms/StepRangeTest.cpp
[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/platform/Decimal.cpp
[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/platform/Decimal.h
[modify] https://crrev.com/ee4915d796448f4024de2c943a52b007021ead03/third_party/WebKit/Source/platform/DecimalTest.cpp

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4923981237059584

Fuzzer: inferno_twister
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  alignedMaximum <= stepRange.maximum()
  blink::InputType::applyStep
  blink::InputType::stepUp
  

Minimized Testcase (7.40 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94fexIJ-h8KGQuQK0o6wbk9rJH65xsz4TrvQ2srbsSBbwR2J_F3GD5sVWRE5k6Kg72tNez0PJLw8RlxTfoovg8C3ejXibW0ioSx9jPrba_QqZ1lo-jF2_gwrli7woArgkswLNTOa4qIa6FOuTUEpXiIEj-UjA

Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot