Suggested culprit in the report looks unlikely to me, but I'm no expert. Can you take a look meade@?

ClusterFuzz has detected this issue as fixed in range 440242:440280.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4513614192181248

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::CSSSelectorParser::consumeANPlusB
  blink::CSSSelectorParser::consumePseudo
  blink::CSSSelectorParser::consumeSimpleSelector
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=435261:438085
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=440242:440280

Minimized Testcase (0.36 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97f24JzpxmLwdw3-b8bJFQ-3t2Hk9Hmliy_dIKPhW3khbpX6XJbrt2V3cR-9FwAhDnM_l5oHom5pr9DJ5OlkzJ4yWXhWs8Stc2aEjxy9GSHeoWSEQ2VZFLxeZUbdD_0sLOfej7E-QlrcII97B9VjA5LnnShVw?testcase_id=4513614192181248

Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.