Handle overflow, underflow in XPath substring position, length.

third_party/WebKit/Source/core/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/chromecast_build.gni")
 import("//build/toolchain/toolchain.gni")
 import("//build/config/ui.gni")
 import("//build/split_static_library.gni")
 import("//testing/libfuzzer/fuzzer_test.gni")
 import("//third_party/WebKit/Source/bindings/bindings.gni")
@@ skipping 1240 matching lines @@
     "svg/UnsafeSVGAttributeSanitizationTest.cpp",
     "svg/graphics/SVGImageTest.cpp",
     "testing/PrivateScriptTestTest.cpp",
     "timing/MemoryInfoTest.cpp",
     "timing/PerformanceBaseTest.cpp",
     "timing/PerformanceObserverTest.cpp",
     "timing/PerformanceTest.cpp",
     "workers/DedicatedWorkerTest.cpp",
     "workers/WorkerThreadTest.cpp",
     "workers/WorkerThreadTestHelper.h",
+    "xml/XPathFunctionsTest.cpp",
     "xml/parser/SharedBufferReaderTest.cpp",
   ]
 
   configs += [
     "//third_party/WebKit/Source:config",
     "//third_party/WebKit/Source:inside_blink",
   ]
 
   deps = [
     ":core",
@@ skipping 20 matching lines @@
   sources = [
     "html/parser/HTMLPreloadScannerFuzzer.cpp",
     "html/parser/TextResourceDecoderForFuzzing.h",
   ]
   seed_corpus = "//third_party/WebKit/LayoutTests/fast/parser"
   deps = [
     ":core",
     "../platform:blink_fuzzer_test_support",
   ]
 }