Suspected CL
https://codereview.chromium.org/2328623003
glebl@, could you please take a look and help us to find correct owner if it is not related your changes.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e451db7ebedfa9a2b43b99f4c789cdde7ca97421

commit e451db7ebedfa9a2b43b99f4c789cdde7ca97421
Author: glebl <glebl@chromium.org>
Date: Tue Feb 21 19:41:07 2017

Make LayoutListItem::value to use SaturatedAddition to prevent integer overflow

The problem has been spotted by UBSan.
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4949437635100672

BUG= 658714 

Review-Url: https://codereview.chromium.org/2695223007
Cr-Commit-Position: refs/heads/master@{#451822}

[modify] https://crrev.com/e451db7ebedfa9a2b43b99f4c789cdde7ca97421/third_party/WebKit/Source/core/layout/LayoutListItem.cpp

ClusterFuzz has detected this issue as fixed in range 451788:451857.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4949437635100672

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  blink::LayoutListItem::calcValue
  blink::LayoutListItem::updateValueNow
  blink::LayoutListItem::value
  
Sanitizer: undefined (UBSAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=370022:370027
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=451788:451857

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv953AvokF7gdTV6WX4dDgeIKZfJc7GYxlPoA0xEsRbXrr4-1pTHv2u69TXZVcwvtORMEZJbraugvnVL6KohEUkWmgXj26Rhhz3Eba8JwIGwRKmv9cPXuYHiG9dbQpLHrIekYBa1S-LS_iqGQJINXtA28NSgDRA?testcase_id=4949437635100672


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.