Prevent integer overflows in ANPlusB handling

third_party/WebKit/Source/core/css/parser/CSSSelectorParserTest.cpp

Index: third_party/WebKit/Source/core/css/parser/CSSSelectorParserTest.cpp
diff --git a/third_party/WebKit/Source/core/css/parser/CSSSelectorParserTest.cpp b/third_party/WebKit/Source/core/css/parser/CSSSelectorParserTest.cpp
index 08abeef92d575ce77255380052b964b3cc68ec5f..b2e0294c0a43ff94616f8fcdf84e6117901c4a1c 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSSelectorParserTest.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSSelectorParserTest.cpp
@@ -69,6 +69,12 @@ TEST(CSSSelectorParserTest, ValidANPlusB)
         {"+n/**/- 48", 1, -48},
         {"-n + 81", -1, 81},
         {"-N - 88", -1, -88},
+
+        {"3091970736n + 1", std::numeric_limits<int>::max(), 1},
+        {"-3091970736n + 1", std::numeric_limits<int>::min(), 1},
+        // B is calculated as +ve first, then negated.
+        {"N- 3091970736", 1, -std::numeric_limits<int>::max()},
+        {"N+ 3091970736", 1, std::numeric_limits<int>::max()},
     };
 
     for (auto testCase : testCases) {
@@ -79,8 +85,8 @@ TEST(CSSSelectorParserTest, ValidANPlusB)
         CSSParserTokenRange range = scope.tokenRange();
         bool passed = CSSSelectorParser::consumeANPlusB(range, ab);
         EXPECT_TRUE(passed);
-        EXPECT_EQ(ab.first, testCase.a);
-        EXPECT_EQ(ab.second, testCase.b);
+        EXPECT_EQ(testCase.a, ab.first);
+        EXPECT_EQ(testCase.b, ab.second);
     }
 }
 
@@ -301,7 +307,7 @@ TEST(CSSSelectorParserTest, SerializedUniversal)
         CSSParserTokenRange range = scope.tokenRange();
         CSSSelectorList list = CSSSelectorParser::parseSelector(range, context, sheet);
         EXPECT_TRUE(list.isValid());
-        EXPECT_STREQ(testCase[1], list.selectorsText().ascii().data());
+        EXPECT_STREQ(list.selectorsText().ascii().data(), testCase[1]);
     }
 }