Avoid integer overflow in LayoutUnit's unary minus operator

third_party/WebKit/Source/platform/LayoutUnit.h

 /*
  * Copyright (c) 2012, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 626 matching lines @@
     return LayoutUnit(a) - b;
 }
 
 inline float operator-(const float a, const LayoutUnit& b)
 {
     return a - b.toFloat();
 }
 
 inline LayoutUnit operator-(const LayoutUnit& a)
 {
+    // -min() is saturated to max().
+    if (a == LayoutUnit::min())
+        return LayoutUnit::max();
+
     LayoutUnit returnVal;
     returnVal.setRawValue(-a.rawValue());
     return returnVal;
 }
 
 // For returning the remainder after a division with integer results.
 inline LayoutUnit intMod(const LayoutUnit& a, const LayoutUnit& b)
 {
     // This calculates the modulo so that: a = static_cast<int>(a / b) * b + intMod(a, b).
     LayoutUnit returnVal;
@@ skipping 150 matching lines @@
 }
 
 inline std::ostream& operator<<(std::ostream& stream, const LayoutUnit& value)
 {
     return stream << value.toDouble();
 }
 
 } // namespace blink
 
 #endif // LayoutUnit_h