Fix numeric overflow handling in LayoutRubyBase

Source/core/layout/LayoutRubyBase.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 122 matching lines @@
 {
     return JUSTIFY;
 }
 
 void LayoutRubyBase::adjustInlineDirectionLineBounds(unsigned expansionOpportunityCount, LayoutUnit& logicalLeft, LayoutUnit& logicalWidth) const
 {
     int maxPreferredLogicalWidth = this->maxPreferredLogicalWidth();
     if (maxPreferredLogicalWidth >= logicalWidth)
         return;
 
+    unsigned maxCount = static_cast<unsigned>(LayoutUnit::max().floor());

[wkorman, 2015/08/11 01:03:32]

Do we need to worry about similar overflow here?

https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...

Unit tests for this class could be worthwhile at some point to catch this and
similar.

+    if (expansionOpportunityCount > maxCount)
+        expansionOpportunityCount = maxCount;
+
     // Inset the ruby base by half the inter-ideograph expansion amount.
     LayoutUnit inset = (logicalWidth - maxPreferredLogicalWidth) / (expansionOpportunityCount + 1);
 
     logicalLeft += inset / 2;
     logicalWidth -= inset;
 }
 
 } // namespace blink