Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/2c863229da24ed1cb180759c9342e7a5125fd6f5 (Add ImageData constructor from StaticBitmapImage).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

Overflow in setting up painting operations with very large inputs is generally not a problem.

Not so fast. The behavior of this type of overflow is undefined in C++, we should at least make it deterministic by implementing a clamping cast.  Something like:

static float ClampDoubleToFloat(double val)
{
  if( val > FLT_MAX )
    return FLT_MAX;
  if( val < -FLT_MAX )
    return -FLT_MAX;
  return (float)val;
}

Feel free to go for it, but not at the expense of killing performance.

The double -> float narrowing is easier to handle as s/roundf/round/ in this case - still a risk of (integer) overflow when subsequently returning the value though. So clampTo<int>(round(...)).
Seeing that the Length code-path uses LayoutUnit though it would probably make sense to just do:

return LayoutUnit(<double-mult>).Round();

(since LayoutUnit(double) does a saturating cast) and thus get the same (LayoutUnit) limits in both cases.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a54a49ef40bbf24f45ab851a16cbb291faae38f1

commit a54a49ef40bbf24f45ab851a16cbb291faae38f1
Author: Reza.Zakerinasab <zakerinasab@chromium.org>
Date: Fri Apr 27 13:41:05 2018

Fix float cast overflow in ComputeEdgeWidth

Bug:  836640 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: Ib64f5ca69116badb0b2a5ef84890b51d2742cfaa
Reviewed-on: https://chromium-review.googlesource.com/1030811
Reviewed-by: Stephen Chenney <schenney@chromium.org>
Commit-Queue: Mohammad Reza Zakerinasab <zakerinasab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#554371}
[modify] https://crrev.com/a54a49ef40bbf24f45ab851a16cbb291faae38f1/third_party/blink/renderer/core/paint/nine_piece_image_grid.cc

ClusterFuzz has detected this issue as fixed in range 554370:554371.

Detailed report: https://clusterfuzz.com/testcase?key=5768750788509696

Fuzzer: inferno_twister
Job Type: linux_ubsan_chrome
Platform Id: linux

Crash Type: Float-cast-overflow
Crash Address: 
Crash State:
  blink::ComputeEdgeWidth
  blink::NinePieceImageGrid::NinePieceImageGrid
  PaintPieces
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=523880:523906
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=554370:554371

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5768750788509696

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5768750788509696 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.