Find it Results:
----------------
Suspected CLs	The result is a list of CLs that change the crashed files.

Author: mstensho
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/c2025efb0537e16c304c37b1df4d687ec698cd68
Time: Thu Oct 13 18:56:07 2016
Lines 1183-1190 of file LayoutTableSection.cpp which potentially caused crash are changed in this cl (frame #3, "blink::LayoutTableSection::layoutRows").

Lines 5506-5512 of file LayoutBox.cpp which potentially caused crash are changed in this cl (frame #2, "blink::LayoutBox::crossesPageBoundary").
Minimum distance from crash line to modified line: 0. (file: LayoutBox.cpp, crashed on: 5506, modified: 5506).

Suspected Project: chromium
Suspected Component: Blink>Layout

based on Findit results, mstensho@, could you please check the issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5fe33d9b08d983eaa6dc22f936f4a5f50442517a

commit 5fe33d9b08d983eaa6dc22f936f4a5f50442517a
Author: mstensho <mstensho@opera.com>
Date: Fri Oct 14 19:18:02 2016

Correctly check if we have a valid page height before checking remaining space.

LayoutState::pageLogicalHeight() is bogus, and the sooner we convince it to
take a long walk on the short pier, the better. :(

Additionally, bail out earlier from fragmentation-specific code. No need to
waste time on calling crossesPageBoundary() when not fragmented.

BUG= 655911 

Review-Url: https://codereview.chromium.org/2413413003
Cr-Commit-Position: refs/heads/master@{#425420}

[add] https://crrev.com/5fe33d9b08d983eaa6dc22f936f4a5f50442517a/third_party/WebKit/LayoutTests/fragmentation/abspos-table-in-nested-multicol-crash.html
[modify] https://crrev.com/5fe33d9b08d983eaa6dc22f936f4a5f50442517a/third_party/WebKit/Source/core/layout/LayoutBox.cpp
[modify] https://crrev.com/5fe33d9b08d983eaa6dc22f936f4a5f50442517a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp

 Issue 656152  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 425398:425517.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5976970943004672

Fuzzer: marty_html_twiddler
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: Floating-point-exception
Crash Address: 
Crash State:
  blink::LayoutBox::pageRemainingLogicalHeightForOffset
  blink::LayoutBox::crossesPageBoundary
  blink::LayoutTableSection::layoutRows
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=425052:425143
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=425398:425517

Minimized Testcase (0.96 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96e-RG9uZusJA2JV0KrNusAI9xykADKV4XPmfDQm0CMT8Hn2PI-jSwwdrs5OfLt0Zg67ahxIkuLHjzjxTsWElk0KNzMjbK42m1ceU6uobNHNw4U64W9rTTui2ldnp-8FzmeB7gBDALflyTZlTlZtCFI4ilYtA?testcase_id=5976970943004672
<style>
.c10[class*="c10"] { overflow: hidden; -webkit-column-width: 65536px; }
.c11 { text-decoration: underline; -webkit-appearance: button; -webkit-column-width: 1px; }
.c18 { visibility: hidden; position: absolute; }
.c19 { position: relative; float: right;</style>
<script>
var nodes = Array();
 nodes[33] = document.createElement('tfoot'); 
 nodes[33].setAttribute('class', 'c19'); 
 nodes[35] = document.createElement('table'); 
 nodes[35].setAttribute('class', 'c18'); 
 nodes[59] = document.createElement('td'); 
 nodes[59].setAttribute('class', 'c10'); 
 document.documentElement.appendChild(nodes[59]); 
 nodes[69] = document.createElement('dl'); 
 nodes[35].appendChild(nodes[69]); 
 nodes[73] = document.createElement('mark'); 
 nodes[73].setAttribute('class', 'c11'); 
 nodes[33].appendChild(nodes[73]); 
 nodes[96] = document.createElement('td'); 
 nodes[73].appendChild(nodes[96]); 
 nodes[96].appendChild(nodes[35]); 
 nodes[59].appendChild(nodes[33]); 
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Issue 657487 has been merged into this issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot