Prevent integer overflows in ANPlusB handling

third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp
index 3812e28f332de01fa2174a488be78f47dfb76f4e..e7f1ded790eb35897c8cc746936827eba5d268d4 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp
@@ -642,7 +642,7 @@ bool CSSSelectorParser::consumeANPlusB(CSSParserTokenRange& range, std::pair<int
 {
     const CSSParserToken& token = range.consume();
     if (token.type() == NumberToken && token.numericValueType() == IntegerValueType) {
-        result = std::make_pair(0, static_cast<int>(token.numericValue()));
+        result = std::make_pair(0, clampTo<int>(token.numericValue()));
         return true;
     }
     if (token.type() == IdentToken) {
@@ -664,7 +664,7 @@ bool CSSSelectorParser::consumeANPlusB(CSSParserTokenRange& range, std::pair<int
         result.first = 1;
         nString = range.consume().value().toString();
     } else if (token.type() == DimensionToken && token.numericValueType() == IntegerValueType) {
-        result.first = token.numericValue();
+        result.first = clampTo<int>(token.numericValue());
         nString = token.value().toString();
     } else if (token.type() == IdentToken) {
         if (token.value()[0] == '-') {
@@ -710,9 +710,13 @@ bool CSSSelectorParser::consumeANPlusB(CSSParserTokenRange& range, std::pair<int
         return false;
     if ((b.numericSign() == NoSign) == (sign == NoSign))
         return false;
-    result.second = b.numericValue();
-    if (sign == MinusSign)
+    result.second = clampTo<int>(b.numericValue());
+    if (sign == MinusSign) {
+        // Negating minimum integer returns itself, instead return max integer.
+        if (UNLIKELY(result.second == std::numeric_limits<int>::min()))
+            result.second = std::numeric_limits<int>::max();
         result.second = -result.second;
+    }
     return true;
 }