might be suspected cl :https://chromium.googlesource.com/chromium/src/+/cf1113301b3c251c09ac7f7576b4f98bebf64f25%5E%21/cc/tiles/picture_layer_tiling_set.cc

vmpstr@ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/50000257dcf62a1c146c03617c7f1100800faf28

commit 50000257dcf62a1c146c03617c7f1100800faf28
Author: vmpstr <vmpstr@chromium.org>
Date: Sat Sep 10 00:06:02 2016

gfx: Do the ToEnclosingRect in double precision.

This patch changes ToEnclosingRect to use doubles instead of float
when computing width/height, since lack of precision in floats can
cause incorrect values (as shown in the test).

R=danakj
BUG= 644873 
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel

Review-Url: https://codereview.chromium.org/2327903002
Cr-Commit-Position: refs/heads/master@{#417772}

[modify] https://crrev.com/50000257dcf62a1c146c03617c7f1100800faf28/cc/playback/discardable_image_map_unittest.cc
[modify] https://crrev.com/50000257dcf62a1c146c03617c7f1100800faf28/ui/gfx/geometry/rect_conversions.cc
[modify] https://crrev.com/50000257dcf62a1c146c03617c7f1100800faf28/ui/gfx/geometry/rect_unittest.cc

ClusterFuzz has detected this issue as fixed in range 417755:417785.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6363992669028352

Fuzzer: attekett_dom_fuzzer
Job Type: linux_debug_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  eventually_rect_in_layer_space_.Contains(skewport_in_layer_space_) in picture_la
  cc::PictureLayerTilingSet::UpdatePriorityRects
  cc::PictureLayerTilingSet::UpdateTilePriorities
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=391600:391649
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_chrome&range=417755:417785

Minimized Testcase (0.34 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97uik4p12UmGB0XbFyKqEQ9wjhiucpAvNBBqm_9dLWA1MNPCoFqksCIs-_a62bect3XvuUbRnWTRSkp0sCOQqz_i-swAY0dXPyp5dmUtcWiQQhjVUcOvQ0cpja6BjAtP_A--ClRqx11J8FMhko2bWVghEglXQ?testcase_id=6363992669028352

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot