Author: mstensho
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/fe283ea1ad33abe251cbb4a921f7f836085bab82
Time: Fri Mar 11 14:19:18 2016
The CL last changed line 1189 of file LayoutBlockFlow.cpp, which is stack frame 6.

ClusterFuzz has detected this issue as fixed in range 406657:406809.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5315849468772352

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  blink::LayoutBlockFlow::marginBeforeEstimateForChild
  blink::LayoutBlockFlow::estimateLogicalTopPosition
  blink::LayoutBlockFlow::layoutBlockChild
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=378030:378103
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=406657:406809

Minimized Testcase (0.08 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94t1zWrVrWYn4L9KSmr7IA_gznwZzuoygZ1TLjTz9ICO8Pby-lBFJ38N4vQc9Gpulr7fY_gYAwsAZsKe6jruIZjHS0O_Ef017GPeRLeR4aJcPXNke2utmtHwQVtaED0ynPrSi8D0eLpaF5XS1hENs7ma32RHw?testcase_id=5315849468772352
<style>
* { animation-name: cfpulse98;106); margin-top: calc(1% - 4294967227px);


Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot