Avoid integer-overflow in hb_glyph_position_t.y_advance

third_party/WebKit/Source/platform/fonts/shaping/ShapeResult.cpp

Index: third_party/WebKit/Source/platform/fonts/shaping/ShapeResult.cpp
diff --git a/third_party/WebKit/Source/platform/fonts/shaping/ShapeResult.cpp b/third_party/WebKit/Source/platform/fonts/shaping/ShapeResult.cpp
index e05e7b13da28da65a3873b572c727bd5b5916c04..9893ee4cc4098d0715a70881109f291b34dae37f 100644
--- a/third_party/WebKit/Source/platform/fonts/shaping/ShapeResult.cpp
+++ b/third_party/WebKit/Source/platform/fonts/shaping/ShapeResult.cpp
@@ -311,7 +311,12 @@ void ShapeResult::insertRun(std::unique_ptr<ShapeResult::RunInfo> runToInsert,
 
         // One out of x_advance and y_advance is zero, depending on
         // whether the buffer direction is horizontal or vertical.
-        float advance = harfBuzzPositionToFloat(pos.x_advance - pos.y_advance);
+        // Convert to float and negate to avoid integer-overflow for ULONG_MAX.
+        float advance;
+        if (LIKELY(pos.x_advance))
+            advance = harfBuzzPositionToFloat(pos.x_advance);
+        else
+            advance = -harfBuzzPositionToFloat(pos.y_advance);
 
         run->m_glyphData[i].characterIndex =
             glyphInfos[startGlyph + i].cluster - startCluster;