Author: eae@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/70e39074ac4ebdf18d406fbd56a5ddde4c8e989e
Time: Wed Nov 07 18:33:44 2012
The CL last changed line 648 of file LayoutUnit.h, which is stack frame 0.

Author: wangxianzhu@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/75d0d2d3144bf7df9970f81d1cd6e9f0ff5be221
Time: Wed Jun 17 22:42:16 2015
The CL last changed line 120 of file SVGRootInlineBox.cpp, which is stack frame 1.

Author: leo.yang@torchmobile.com.cn
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/431c6d5d635f44a3b04975183028923395536765
Time: Fri May 20 07:56:57 2011
The CL last changed line 71 of file SVGRootInlineBox.cpp, which is stack frame 2.

Author: gyuyoung.kim@samsung.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/9baf8c49d146020322e29f52fa65a68944d79101
Time: Fri Sep 13 02:55:49 2013
The CL last changed line 729 of file LayoutBlockFlowLine.cpp, which is stack frame 3.

Author: igor.o@sisa.samsung.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/639ba3409ef6d32f45b723a887dee5068679da2a
Time: Tue Nov 05 22:17:28 2013
The CL last changed line 897 of file LayoutBlockFlowLine.cpp, which is stack frame 4.

Author: eae@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/48ed17cf1d50988a715c1d367dc810d575dcb359
Time: Thu Jul 31 20:05:09 2014
The CL last changed line 769 of file LayoutBlockFlowLine.cpp, which is stack frame 5.

Author: leviw@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/b40f5755401fe50b434912aa7400d61b6cbbdb9f
Time: Sat Jan 25 00:19:25 2014
The CL last changed line 1602 of file LayoutBlockFlowLine.cpp, which is stack frame 6.

Suspected Project: chromium
Suspected Component: Blink>SVG

As per code search on file SVGRootInlineBox.cpp, recent changes done by rockot@. could you please help us to find correct owner?
Thank you.

I'm not sure how you came up with my name, I've never touched any of these files. Over to wangxianzhu@ based on your rationale (SVGRootInlineBox.cpp) and CCing fs@opera.com for recent changes to that file.

Thank you very much for your help.

"runtime error: negation of -2147483648 cannot be represented in type int; cast to an unsigned type to negate this value to itself"

-LayoutUnit::min() should be saturated to LayoutUnit::max().

 Issue 629947  has been merged into this issue.

 Issue 629916  has been merged into this issue.

 Issue 629944  has been merged into this issue.

 Issue 629650  has been merged into this issue.

 Issue 629655  has been merged into this issue.

These last three doesn't look like obvious dupes.

Right. I just de-duplicated them.

De-duplicated  bug 629655  and  bug 629944 .  Bug 629650 ,  bug 629916  and  bug 629947  are valid dupes.

Remove crash and stability labels because it doesn't crash on user machines, and this integer overflow do no harm to security and stability.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ef6bea224f0266018c3b4fc63262769020b9a4c2

commit ef6bea224f0266018c3b4fc63262769020b9a4c2
Author: wangxianzhu <wangxianzhu@chromium.org>
Date: Thu Jul 21 00:59:09 2016

Avoid integer overflow in LayoutUnit's unary minus operator

BUG= 629932 

Review-Url: https://codereview.chromium.org/2160983007
Cr-Commit-Position: refs/heads/master@{#406734}

[modify] https://crrev.com/ef6bea224f0266018c3b4fc63262769020b9a4c2/third_party/WebKit/Source/platform/LayoutUnit.h
[modify] https://crrev.com/ef6bea224f0266018c3b4fc63262769020b9a4c2/third_party/WebKit/Source/platform/LayoutUnitTest.cpp

 Issue 630223  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 406657:406809.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6642495433998336

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  blink::SVGRootInlineBox::layoutRootBox
  blink::SVGRootInlineBox::computePerCharacterLayoutInformation
  blink::LayoutBlockFlow::createLineBoxesFromBidiRuns
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=370022:370027
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=406657:406809

Minimized Testcase (1.62 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95OptYABmkme5ihMIQAl1PT9SwQ6kTE1rORmaYtAEi2Ft7GkxG4APIeEn5Tw3XeOYpqCRIgF6eUQclQSzJ1QhcfpkUzPZOZJGzZPpUwPPQzixWaYk-T6DQmiOE2sGorRn6PLe_EBf_QMdCqXuHGpDOQHe9Taw?testcase_id=6642495433998336

Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/224e6490115e915ed5e6bc72a7a0bafe32d29389

commit 224e6490115e915ed5e6bc72a7a0bafe32d29389
Author: wangxianzhu <wangxianzhu@chromium.org>
Date: Thu Jul 21 18:35:18 2016

Better performance for -LayoutUnit

BUG= 629932 

Review-Url: https://codereview.chromium.org/2171813002
Cr-Commit-Position: refs/heads/master@{#406913}

[modify] https://crrev.com/224e6490115e915ed5e6bc72a7a0bafe32d29389/third_party/WebKit/Source/platform/LayoutUnit.h
[modify] https://crrev.com/224e6490115e915ed5e6bc72a7a0bafe32d29389/third_party/WebKit/Source/wtf/SaturatedArithmetic.h
[modify] https://crrev.com/224e6490115e915ed5e6bc72a7a0bafe32d29389/third_party/WebKit/Source/wtf/asm/SaturatedArithmeticARM.h

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot