Prevent integer overflows in ANPlusB handling

third_party/WebKit/Source/core/css/CSSSelectorTest.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/CSSTestHelper.h"
 #include "core/css/RuleSet.h"
 
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
@@ skipping 36 matching lines @@
 
     ".a.b .c {}";
 
     helper.addCSSRules(cssRules);
     EXPECT_EQ(30u, helper.ruleSet().ruleCount()); // .a, .b counts as two rules.
 #ifndef NDEBUG
     helper.ruleSet().show();
 #endif
 }
 
+TEST(CSSSelector, OverflowRareDataMatchNth)
+{
+    int maxInt = std::numeric_limits<int>::max();
+    int minInt = std::numeric_limits<int>::min();
+    CSSSelector selector;
+
+    // Overflow count - b (maxInt - -1 = maxInt + 1)
+    selector.setNth(1, -1);
+    EXPECT_FALSE(selector.matchNth(maxInt));
+    // 0 - (minInt) = maxInt + 1
+    selector.setNth(1, minInt);
+    EXPECT_FALSE(selector.matchNth(0));
+    // minInt - 1
+    selector.setNth(1, 1);
+    EXPECT_FALSE(selector.matchNth(minInt));
+
+    // Overflow b - count (0 - minInt = maxInt + 1)
+    selector.setNth(-1, 0);
+    EXPECT_FALSE(selector.matchNth(minInt));
+    // maxInt - -1 = maxInt + 1
+    selector.setNth(-1, maxInt);
+    EXPECT_FALSE(selector.matchNth(-1));
+    // minInt - 1
+    selector.setNth(-1, minInt);
+    EXPECT_FALSE(selector.matchNth(1));
+
+    // a shouldn't negate to itself (and minInt negates to itself).
+    // Note: This test can only fail when using ubsan.
+    selector.setNth(minInt, 10);
+    EXPECT_FALSE(selector.matchNth(2));
+}
+
 } // namespace blink