Author: wangxianzhu@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/279226447e8a2c2f78f5c1cfd02e481b669fe92b
Time: Wed Aug 05 17:15:27 2015
The CL last changed line 1821 of file ComputedStyle.cpp, which is stack frame 0.

Author: wangxianzhu@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/279226447e8a2c2f78f5c1cfd02e481b669fe92b
Time: Wed Aug 05 17:15:27 2015
The CL last changed line 809 of file InlineFlowBox.cpp, which is stack frame 1.

@wangxianzhu: Assigning to you, request you to please take a look into it. Please help us to reassign if not with respect to your changes.

Thanks.!

ClusterFuzz has detected this issue as fixed in range 410916:411073.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5714309370085376

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  blink::ComputedStyle::outlineOutsetExtent
  blink::InlineFlowBox::addOutlineVisualOverflow
  blink::InlineFlowBox::computeOverflow
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=370022:370027
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=410916:411073

Minimized Testcase (0.42 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96uP1X0BUv0aTnsLhuFem5oTpk-FZB8PB-cBa6LbafoxURJmeB7k1jacIkYgNSu4l_lN6fFuNoEE730tIV_Tt1m1nRkEUlpwjGu2YiUefo8HjVrleEwpuU8YHcecXZozXMBDpXrBpReNwidPklHKWYMUBB7aA?testcase_id=5714309370085376

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot