The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b25ea97e412367de1c639b092c40a5b927fcb8aa

commit b25ea97e412367de1c639b092c40a5b927fcb8aa
Author: Joy Yu <joysyu@google.com>
Date: Tue Aug 29 22:57:25 2017

Fix crash when indexing into column collapse vector

Take the minimum of the number of columns and the number of columns a
cell is spanning. Before, we did'nt take the minimum, so a cell set to
span more columns than the actual number of columns resulted in an
error.

Bug:  758503 
Change-Id: I3257bf3313f3ad09850a531c9ca1c5511d94b0f1
Reviewed-on: https://chromium-review.googlesource.com/642119
Reviewed-by: Emil A Eklund <eae@chromium.org>
Reviewed-by: David Grogan <dgrogan@chromium.org>
Commit-Queue: David Grogan <dgrogan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#498270}
[add] https://crrev.com/b25ea97e412367de1c639b092c40a5b927fcb8aa/third_party/WebKit/LayoutTests/fast/table/table-cell-colspan-exceeds-total-cols-crash.html
[modify] https://crrev.com/b25ea97e412367de1c639b092c40a5b927fcb8aa/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp

ClusterFuzz has detected this issue as fixed in range 498140:498349.

Detailed report: https://clusterfuzz.com/testcase?key=5030184490369024

Fuzzer: mbarbella_webcomponents
Job Type: linux_ubsan_vptr_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  i < size() in Vector.h
  blink::LayoutTableSection::UpdateLogicalWidthForCollapsedCells
  blink::LayoutTable::UpdateLayout
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=496775:496804
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=498140:498349

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5030184490369024

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5030184490369024 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.