We might want to use saturation arthritics here.

arithmetic.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b651ce2c5a8c0583e49712ada7191c8c2b109fe8

commit b651ce2c5a8c0583e49712ada7191c8c2b109fe8
Author: Morten Stenshorne <mstensho@opera.com>
Date: Tue Aug 22 16:38:41 2017

Saturated arithmetic when calculating multicol preferred widths.

With sufficiently large column-gap and high enough column-count, we'd
integer-overflow and end up with a negative gap_extra result, which is a value
that contributes to the preferred min/max preferred logical widths (which
therefore also could become negative). Let all values involved be of type
LayoutUnit, so that we get saturated arithmetic enabled.

Bug:  743230 
Change-Id: I06d7d8f9c1214af35faf0b52f1652fc626cd67ef
Reviewed-on: https://chromium-review.googlesource.com/625624
Commit-Queue: Emil A Eklund <eae@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#496329}
[add] https://crrev.com/b651ce2c5a8c0583e49712ada7191c8c2b109fe8/third_party/WebKit/LayoutTests/fast/multicol/insane-column-gap.html
[modify] https://crrev.com/b651ce2c5a8c0583e49712ada7191c8c2b109fe8/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp

ClusterFuzz has detected this issue as fixed in range 496320:496332.

Detailed report: https://clusterfuzz.com/testcase?key=6167230558765056

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Integer-overflow
Crash Address: 
Crash State:
  blink::LayoutMultiColumnFlowThread::ComputePreferredLogicalWidths
  blink::LayoutBox::MinPreferredLogicalWidth
  blink::LayoutBlock::ComputeChildPreferredLogicalWidths
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=375946:376263
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=496320:496332

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6167230558765056

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6167230558765056 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.