Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4643356933357568

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::AudioParamTimeline::valuesForFrameRangeImpl
  blink::AudioParamTimeline::valuesForFrameRange
  blink::AudioParamHandler::calculateTimelineValues
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=435261:438085

Minimized Testcase (0.98 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95PPSL-ZnYNNoTinAeOrQ3l6nKOjCtY4OTuArPl-HWYNIl8azitxNzk9E_-x7g8V7LbYhuQntiGTLQ7y_JXtLNBUmt7vKzxH_T3chdw6KDb2qAU7Dzkh8zhnsZsjxN3RkFr0hPMgAXa3vXn3DT9IUMw3inGbA?testcase_id=4643356933357568
<script src=../resources/js-test.js></script>
    <script src=resources/audio-testing.js></script>
<script>
      var sampleRate = 48000;
      var renderDuration = 0.125;
      var largeTime = 1e300;
      var audit = Audit.createTaskRunner();
"linearRamp", function () {
      };
      audit.defineTask("exponentialRamp", function () {
        var graph = createGraph();
        graph.gain.gain.exponentialRampToValueAtTime(.1, largeTime);
        graph.source.start();
        graph.context.startRendering();
      });
      audit.runTasks();
      function createGraph() {
        var context = new OfflineAudioContext(1, renderDuration * sampleRate, sampleRate);
        var src = context.createBufferSource();
        src.buffer = createConstantBuffer(context, 1, 1);
        var gain = context.createGain();
        src.connect(gain);
        gain.connect(context.destination);
        return {
          context: context,
          gain: gain,
          source: src
        };
      }
     </script>


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.