Could not find culprit CL using regression range and code search, as per 
 issue 587104  cc-ing mstensho@. could you please take a look and help us to find correct owner.
Thank you.

Need to own the bug in order to be able to access the report.

 Issue 687891  has been merged into this issue.

The assert got changed to count <= maxElementCountInBackingStore<T>() in https://codereview.chromium.org/2657173002 . This bug has the same root cause as  bug 688158 .

ClusterFuzz has detected this issue as fixed in range 454393:454432.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4535478155214848

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  count <= base::kGenericMaxDirectMapped / sizeof(T) in PartitionAllocator.h
  blink::LayoutMultiColumnSet::appendNewFragmentainerGroup
  blink::LayoutMultiColumnFlowThread::appendNewFragmentainerGroupIfNeeded
  
Sanitizer: undefined (UBSAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=443258:443393
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_chrome&range=454393:454432

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96zxlZTgHnFtcaX9axKjDwyDjeCrASVmbvG-dI1TeHAPIbMeaWBLreuoYwz4klpd7-DEXZz9dpW4oDZH_eBU4SkPm-M5F6d--bnZYmyUpD8ZbG_B0v-80rirg2-4PWYxyZuB0uL_zBiFtl8-bGVcmyq8DbgT1NGcLWC966wmbbPVWNMLnq0ugoC6OerrjsX9H0ENA3rRpAegwDy0TuCvO306zgqlzDMXXiWu9nPW7qUn9slD9VCtJcY7FG4ZgtfiH4VkwPwWUouadWa80pE4QwKGCidM4s6IoivKzU4uQjm8vh0dvzfF3Zoz63Fn1Zn_z9nX0L_F7OGsDvYB4-2Nv_khed8Yow64CYcClPQpA2MXLfvK6w?testcase_id=4535478155214848


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.