Find it and CL did not provide any possible suspects.
Assigning to the concern owner from Code Search using the file, "desktop_window_tree_host_x11.cc"

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/baad79f91de6ea9fd9ecc1b94980d71f2e7b92c1

@varkha --  Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Could it be a fuzzing change r370026? It is in the range. Also I don't think the commit in#1 is in play here - there's no theme change in the call stack is there? It should be possible to come firm this with a revert of either CL.

brotli fuzzer is a standalone binary, not included into chromium.

Line `unsigned long cardinality = static_cast<int>(opacity * 255) * 0x1010101;` seems to be obviously the cause of overflow (when opacity < 0 or opacity > 0.5).

First, casting to int is wrong, something unsigned should be used.
Second, `opacity` value should be clamped to [0.0, 1.0]
Third, I think it is preferable to create uint8_t value and then clone it with logical, but not arithmetical operations (this is not performance critical path, we don't care if we trade one multiplication to 2 shift + 2 or).

Going to check what caused bad `opacity` values, and fix it (or find right owner).

Most probably new crash is caused by rolling new clang that allows better undefined behavior detection.

Opacity is set to `const float kDragWidgetOpacity = .75f;`.
As I mentioned earlier, this will obviously cause cause integer overflow.

Fix: https://codereview.chromium.org/2598383002/

Seems to be introduced on 25 May 2016 with https://codereview.chromium.org/2009333002

ClusterFuzz testcase 4570807469867008 is flaky and no longer reproduces, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Waiting for review: https://codereview.chromium.org/2598383002/

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0f6dfbc4793fab2a08ea912039ca8ed6f958d81d

commit 0f6dfbc4793fab2a08ea912039ca8ed6f958d81d
Author: eustas <eustas@chromium.org>
Date: Fri Jan 27 10:50:43 2017

Fix integer overflow.

BUG= 676902 

Review-Url: https://codereview.chromium.org/2598383002
Cr-Commit-Position: refs/heads/master@{#446639}

[modify] https://crrev.com/0f6dfbc4793fab2a08ea912039ca8ed6f958d81d/ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc
[modify] https://crrev.com/0f6dfbc4793fab2a08ea912039ca8ed6f958d81d/ui/views/widget/widget.cc