UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.70 Safari/537.36

Steps to reproduce the problem:
I'm not sure what to do with this report. This is in code that's not shipped in Chromium today. I don't know if custom pdfium implementations use it. You have to build pdfium with pdf_use_skia_paths enabled. I only do so because that code tends to be faster than agg. And you get bonus skia paths coverage.

From what I've gathered, the intention is still to ship this in Chromium, so it could be enabled tomorrow. It already was, only to be reverted.

https://chromium.googlesource.com/chromium/src/+/1545ba94087279c773705760d51b728d709fd72d

Anyway, here is the ASAN report.

==15308==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fa784e1fa48 at pc 0x000000d2c576 bp 0x7ffe76f73180 sp 0x7ffe76f73178
READ of size 4 at 0x7fa784e1fa48 thread T0
    #0 0xd2c575 in operator-(SkPoint const&, SkPoint const&) third_party/skia/include/core/SkPoint.h:494:26
    #1 0xd2c840 in (anonymous namespace)::IntersectSides(SkPoint const&, SkPoint const&, SkPoint const&) core/fxge/skia/fx_skia_device.cpp:463:29
    #2 0xd2330c in (anonymous namespace)::ClipAngledGradient(SkPoint const*, SkPoint*, bool, bool, SkPath*) core/fxge/skia/fx_skia_device.cpp:537:16
    #3 0xd20799 in CFX_SkiaDeviceDriver::DrawShading(CPDF_ShadingPattern const*, CFX_Matrix const*, FX_RECT const&, int, bool) core/fxge/skia/fx_skia_device.cpp:2075:9
    #4 0xb69f81 in CPDF_RenderStatus::DrawShading(CPDF_ShadingPattern const*, CFX_Matrix*, FX_RECT const&, int, bool) core/fpdfapi/render/cpdf_renderstatus.cpp:2091:37
    #5 0xb60110 in CPDF_RenderStatus::ProcessShading(CPDF_ShadingObject const*, CFX_Matrix const*) core/fpdfapi/render/cpdf_renderstatus.cpp:2193:3
    #6 0xb5a642 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject*, CFX_Matrix const*, PauseIndicatorIface*) core/fpdfapi/render/cpdf_renderstatus.cpp:1173:5
    #7 0xb59048 in CPDF_ProgressiveRenderer::Continue(PauseIndicatorIface*) core/fpdfapi/render/cpdf_progressiverenderer.cpp:93:30
    #8 0x93c199 in (anonymous namespace)::RenderPageImpl(CPDF_PageRenderContext*, CPDF_Page*, CFX_Matrix const&, FX_RECT const&, int, bool, IPDFSDK_PauseAdapter*) fpdfsdk/fpdf_view.cpp:124:26
    #9 0x92ff7e in FPDF_RenderPage_Retail(CPDF_PageRenderContext*, void*, int, int, int, int, int, int, bool, IPDFSDK_PauseAdapter*) fpdfsdk/fpdf_view.cpp:905:3
    #10 0x93ae45 in FPDF_RenderPageBitmap fpdfsdk/fpdf_view.cpp:631:3

Address 0x7fa784e1fa48 is located in stack of thread T0 at offset 584 in frame
    #0 0xd1f3df in CFX_SkiaDeviceDriver::DrawShading(CPDF_ShadingPattern const*, CFX_Matrix const*, FX_RECT const&, int, bool) core/fxge/skia/fx_skia_device.cpp:1982

  This frame has 24 object(s):
    [32, 40) 'ref.tmp' (line 1999)
    [64, 80) 'skColors' (line 2004)
    [96, 112) 'skPos' (line 2005)
    [128, 132) 'ref.tmp49' (line 2020)
    [144, 148) 'ref.tmp50' (line 2021)
    [160, 168) 'ref.tmp73' (line 2029)
    [192, 193) 'clipStart' (line 2030)
    [208, 209) 'clipEnd' (line 2031)
    [224, 312) 'paint' (line 2032)
    [352, 392) 'skMatrix' (line 2035)
    [432, 448) 'skRect' (line 2036)
    [464, 480) 'skClip' (line 2038)
    [496, 512) 'skPath' (line 2039)
    [528, 544) 'pts' (line 2045)
    [560, 568) 'agg.tmp'
    [592, 624) 'rectPts' (line 2071) <== Memory access at offset 584 underflows this variable
    [656, 672) 'pts209' (line 2087)
    [688, 696) 'agg.tmp216'
    [720, 760) 'inverse' (line 2101)
    [800, 952) 'stream' (line 2111)
    [1024, 1120) 'cubics' (line 2115)
    [1152, 1168) 'colors' (line 2116)
    [1184, 1216) 'tempCubics' (line 2126)
    [1248, 1256) 'point' (line 2136)

What is the expected behavior?

What went wrong?
^

Did this work before? No 

Chrome version: 66.0.3359.70  Channel: n/a
OS Version: 
Flash Version: