Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4527132719185920

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  blink::operator-
  blink::FramePainter::paint
  paint
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=410031:410187

Minimized Testcase (0.26 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96ytXGwWqfzByBt8KxDLV3qRdxtwmpFctLy4isou9YhiOGO-DB-L_q3FwSoJs0b5oms2jIiO5KQuKQXnh_de8cSqkrzIUOMtGivnR1V-BwzcbK8Wd80aEEzr0jvsqro-orGXIvAEF4nEVW5ETAb01af0vddtg?testcase_id=4527132719185920

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.