Author: mstensho@opera.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/112f7d91b872201c590ee634c675bef7bf46c554
Time: Thu Jun 18 20:05:00 2015
The CL last changed line 54 of file LayoutPagedFlowThread.cpp, which is stack frame 0.

@mstensho: Assigning to you, request you to please take a look into it. Please help us to reassign if not with respect to your change.

Thanks.!

Reproduced. Mine.

ClusterFuzz has detected this issue as fixed in range 413791:414128.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6742624853819392

Fuzzer: inferno_twister
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  paddedLogicalBottomInFlowThread >= columnSet->logicalBottomInFlowThread()
  blink::LayoutPagedFlowThread::layout
  blink::LayoutMultiColumnFlowThread::layoutColumns
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=344313:344352
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=413791:414128

Minimized Testcase (0.37 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96ZBXT5ypV1QmYCJcfPw3jL1qskrcx5IRyNEI08LAOQMGlXXoUvgxRXmQ-kJ3E2NXDh2RC8yeCEHlac6GfiLFjCo9atMdWqMFMIySr-SFbCyWQMX9ni14o1d7Q7DEkoXeDGrB-bTS_RmSLOOfNktpHwoXtkyg?testcase_id=6742624853819392
<p>2.	B.sY^.VrVP?V99	DKOC]&amp;YM	6	Pc+p0B
Rj
a]	Q.$.EVu0	u!qNd
n/Tuih	Y/HG	N2=%n]88]bJdm p	
 3!1+.7
 	n%bm6 S3-e
)5q!lC
Kg q_&amp;ji{5lUV|	wrg9WGr
ZY
s
F
Th
V
9Q
UN
N_
<style>
* { animation-name: cfpulse92; overflow-y: -webkit-paged-y;0.820300); zoom: 255;  }<style>
@keyframes cfpulse1 { 0% { opacity: 0.8819;  } }
* { animation-name: cfpulse98; max-height: 24.7873951498%;


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot