Based on code search on file tiling_data.h, suspected cl could be
https://chromium.googlesource.com/chromium/src/+/a960b5558d7210bb5bfa67a832f800bb36e629a7
vmpstr@, could you please take a look and reassign if it is not your related changes.

Thank you

I don't seem to have access to the unminimized testcase. Is it possible to get the testcase somehow?

Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Here is the attached test case.

Deleted: fuzz-lyt-foreignObject-case-styling1466735834.04.html 628 bytes

fuzz-lyt-foreignObject-case-styling1466735834.04.html 628 bytes View Download

I can't seem to reproduce on linux. Is this a reproducible result?

Yes, it is reproducible result.

This issue is Pri-1 but has already been moved once. Lowering the priority and moving to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz has detected this issue as fixed in range 402134:402142.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5715210698752000

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  i < num_tiles_x_ in tiling_data.h
  cc::TilingData::AssertTile
  cc::TilingData::TileBoundsWithBorder
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=333489:333691
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=402134:402142

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96L-e8Li4u7EMvGpmqY1CFI5LgUJhXH2Kq0BjXJQdQSKpSQ3LwD656eQpqfz-fYeU5rYwGi_SIoRyZfsICtEkaaGuUu7pmgz9mQuD8mXTdlQlfC11WlVPRjEPqh8kTZo7HiftYlq9OTFQNiXhLJX-uJYiFAeA?testcase_id=5715210698752000


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot