Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5431941445976064

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_asan_chrome_v8_arm_ignition
Platform Id: linux

Crash Type: Floating-point-exception
Crash Address: 
Crash State:
  blink::LayoutMultiColumnSet::pageRemainingLogicalHeightForOffset
  blink::LayoutFlowThread::pageRemainingLogicalHeightForOffset
  blink::LayoutBox::pageRemainingLogicalHeightForOffset
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm_ignition&range=436997:437094

Minimized Testcase (0.16 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96DrKrbV-RdDW3Fo3cRaXnjpQA_Yg6k0qUcWCoDPIfP2cnL1zrZmghZfYJD_xva5S_U-p2WbXERFLA-m3Z0QayJ78ky0WFVvAmnAE13gwGaTHaE3QL29uaHYBrBJlIye8OXnVfRMiM00fts9XUk74HQ3ORlpOF-0XCgF7e-ikwEqQSnlmRRlLFF58x2i9kJkmtHd-eSVzXFl-D66-n8ZmZpj7dFHZqZAjQi0rG4sRKT1sc9GdsLpp0xz2sn3qoOc4hRrpJV6pZz0NdX50LgJ9aBhx2COho5kg29dU-333HWNHqHESfpn-NtAJIcpJVnulJ3p51dkQzutZHBs3qk8nTHBb7LySqPtiVEt6ORj7eeU38eG8E?testcase_id=5431941445976064
  <script>
   try {
    __f_196();
} catch(e) { print(); }
  </script>
 <p>
   &gt;
  <menu>
   <style>
	 * { animation-name: cfpulse86; overflow-y: -webkit-paged-y;


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.