Avoid integer overflow in LayoutUnit's unary minus operator

third_party/WebKit/Source/platform/LayoutUnit.h

Index: third_party/WebKit/Source/platform/LayoutUnit.h
diff --git a/third_party/WebKit/Source/platform/LayoutUnit.h b/third_party/WebKit/Source/platform/LayoutUnit.h
index 6611ca345d28169f96664a8977cf5e2fecc7521d..f8fd072314a06f65754c9f9277faa8a0d42a32cd 100644
--- a/third_party/WebKit/Source/platform/LayoutUnit.h
+++ b/third_party/WebKit/Source/platform/LayoutUnit.h
@@ -644,6 +644,10 @@ inline float operator-(const float a, const LayoutUnit& b)
 
 inline LayoutUnit operator-(const LayoutUnit& a)
 {
+    // -min() is saturated to max().
+    if (a == LayoutUnit::min())
+        return LayoutUnit::max();
+
     LayoutUnit returnVal;
     returnVal.setRawValue(-a.rawValue());
     return returnVal;