Regression information is not available. The result is the blame information.

Author: glebl
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/6b2b9c70636afcc1127e6b199d482a5ffee3fd84
Time: Wed Jul 13 02:09:51 2016
The CL last changed line 73 of file StyleGeneratedImage.cpp, which is stack frame 6.

Suspected Project: chromium
Suspected Component: Blink>CSS
================
glebl@: Could you please look into this issue if it is related to your change, else please help us in assigning it to the right owner.

Thanks!

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5474088453931008

Fuzzer: inferno_twister
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  !std::isnan(static_cast<double>(value))
  float clampTo<float, float>
  blink::ellipseRadius
  

Minimized Testcase (0.40 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97QPZeufBNhurR8pOAQBNf4IJLdbGaYwSwzm-SUeWlCKDlHHnFWAGTXZqnHJ2_jkvWyKhMf0rYsPZdo_y2_ZUKWf_J8LougvxfblOkXGNiAv8bkoodzuLdZmaZDfY9ZJTrSuWcwVEpo49boCmYHHjuVzHL_8w?testcase_id=5474088453931008

Filer: rnimmagadda

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

in both cases the crash happens inside of this call
->    return toCSSRadialGradientValue(this)->image(layoutObject, size);
I didn't change this line in my patch. It's not related to CSS Paint API.

Perhaps ikilpatrick@ can suggest the right owner.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/12e75eb8410fa67bea37acf432f60c191156dea0

commit 12e75eb8410fa67bea37acf432f60c191156dea0
Author: sashab <sashab@chromium.org>
Date: Wed Aug 10 07:02:43 2016

Fixed crash with zero/infinite aspect ratio radial gradients

BUG= 630569 ,635727

Review-Url: https://codereview.chromium.org/2221793004
Cr-Commit-Position: refs/heads/master@{#410989}

[add] https://crrev.com/12e75eb8410fa67bea37acf432f60c191156dea0/third_party/WebKit/LayoutTests/fast/gradients/css3-radial-gradients-zero-radius-crash.html
[modify] https://crrev.com/12e75eb8410fa67bea37acf432f60c191156dea0/third_party/WebKit/Source/core/css/CSSGradientValue.cpp

Re-opening to let clusterfuzz close this issue.

ClusterFuzz has detected this issue as fixed in range 410916:411073.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6135646611832832

Fuzzer: inferno_twister
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  !std::isnan(static_cast<double>(value))
  float clampTo<float, float>
  blink::ellipseRadius
  
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=410916:411073

Minimized Testcase (0.13 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95c5Oe16_zt4wLwsbmmxhw__84noesufiTOFW2FgdHJELbZZCdyMCZfPyuWo7OoAH8ScACtEU-GjhunN_GY77qQr_ma_xIGjhxNwjjfsEmsc6UWJye4WFAYhgT4kkxNrtKrYw13ruhnstU7AjJJR-gsweYGhA?testcase_id=6135646611832832

Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 410916:411073.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5474088453931008

Fuzzer: inferno_twister
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  !std::isnan(static_cast<double>(value))
  float clampTo<float, float>
  blink::ellipseRadius
  
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=410916:411073

Minimized Testcase (0.40 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97QPZeufBNhurR8pOAQBNf4IJLdbGaYwSwzm-SUeWlCKDlHHnFWAGTXZqnHJ2_jkvWyKhMf0rYsPZdo_y2_ZUKWf_J8LougvxfblOkXGNiAv8bkoodzuLdZmaZDfY9ZJTrSuWcwVEpo49boCmYHHjuVzHL_8w?testcase_id=5474088453931008

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot