Avoid integer overflow in LayoutUnit's unary minus operator

third_party/WebKit/Source/platform/LayoutUnitTest.cpp

Index: third_party/WebKit/Source/platform/LayoutUnitTest.cpp
diff --git a/third_party/WebKit/Source/platform/LayoutUnitTest.cpp b/third_party/WebKit/Source/platform/LayoutUnitTest.cpp
index 61818cb504c516d24e11d6582b1c949bdfca04f9..4b27c33b7daa8fc4362ceee89d177120cfc002b7 100644
--- a/third_party/WebKit/Source/platform/LayoutUnitTest.cpp
+++ b/third_party/WebKit/Source/platform/LayoutUnitTest.cpp
@@ -256,4 +256,19 @@ TEST(LayoutUnitTest, LayoutUnitFloatOverflow)
     EXPECT_EQ(intMinForLayoutUnit, LayoutUnit(-176972000.0).toInt());
 }
 
+TEST(LayoutUnitTest, UnaryMinus)
+{
+    EXPECT_EQ(LayoutUnit(), -LayoutUnit());
+    EXPECT_EQ(LayoutUnit(999), -LayoutUnit(-999));
+    EXPECT_EQ(LayoutUnit(-999), -LayoutUnit(999));
+
+    LayoutUnit negativeMax;
+    negativeMax.setRawValue(LayoutUnit::min().rawValue() + 1);
+    EXPECT_EQ(negativeMax, -LayoutUnit::max());
+    EXPECT_EQ(LayoutUnit::max(), -negativeMax);
+
+    // -LayoutUnit::min() is saturated to LayoutUnit::max()
+    EXPECT_EQ(LayoutUnit::max(), -LayoutUnit::min());
+}
+
 } // namespace blink