commit 671ce62f35049808378ee966da0e7b3acd0be30a
author liyuqian <liyuqian@google.com> Wed Nov 09 07:24:21 2016 -0800
committer Commit bot <commit-bot@chromium.org> Wed Nov 09 07:24:21 2016 -0800
tree 63735d9c245c0b81e017ec4be7ae2514c97e5e70
parent a34e95a77bd0812e4af3dbb3b3f83072fd04a780

Check negative overflow of quickSkFDot6Div

The following fuzz html reveals the bug in chromium content_shell

===html=begins===
<style>
*{min-width:4%;-webkit-border-radius:+256%;}
.CLASS11{text-decoration:rgba(128%,16129%,1%,0.0000000004656612317904879831274006762300773920593144339363789186) dotted blink;vertical-align:124px;-webkit-column-count:2147483655 !important;</style>
<h1 class="CLASS11 CLASS1">
>
B
<button>
<h4 class="CLASS11 CLASS12">
</h4>
<p>
c C
<table>
<caption class="CLASS11">
>
<ruby class="CLASS11 CLASS12">
</ruby>
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA x
===html===ends===

BUG=chromium:662905
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2482863004

Review-Url: https://codereview.chromium.org/2482863004