Avoid integer overflow in WheelEvent constructor

third_party/WebKit/Source/core/events/WheelEvent.cpp

Index: third_party/WebKit/Source/core/events/WheelEvent.cpp
diff --git a/third_party/WebKit/Source/core/events/WheelEvent.cpp b/third_party/WebKit/Source/core/events/WheelEvent.cpp
index 2d23921d8361523c34697fb0d943c77e2c06f68b..689d56af9011e5bd9c14729f85f1aef5f4a778e9 100644
--- a/third_party/WebKit/Source/core/events/WheelEvent.cpp
+++ b/third_party/WebKit/Source/core/events/WheelEvent.cpp
@@ -34,6 +34,14 @@ inline static unsigned convertDeltaMode(const PlatformWheelEvent& event)
     return event.granularity() == ScrollByPageWheelEvent ? WheelEvent::kDomDeltaPage : WheelEvent::kDomDeltaPixel;
 }
 
+// Negate a long value without integer overflow.
+inline static long negateIfPossible(long value)
+{
+    if (value == LONG_MIN)
+        return value;
+    return -value;
+}
+
 WheelEvent* WheelEvent::create(const PlatformWheelEvent& event, AbstractView* view)
 {
     return new WheelEvent(FloatPoint(event.wheelTicksX(), event.wheelTicksY()), FloatPoint(event.deltaX(), event.deltaY()),
@@ -63,8 +71,8 @@ WheelEvent::WheelEvent()
 WheelEvent::WheelEvent(const AtomicString& type, const WheelEventInit& initializer)
     : MouseEvent(type, initializer)
     , m_wheelDelta(initializer.wheelDeltaX() ? initializer.wheelDeltaX() : -initializer.deltaX(), initializer.wheelDeltaY() ? initializer.wheelDeltaY() : -initializer.deltaY())
-    , m_deltaX(initializer.deltaX() ? initializer.deltaX() : -initializer.wheelDeltaX())
-    , m_deltaY(initializer.deltaY() ? initializer.deltaY() : -initializer.wheelDeltaY())
+    , m_deltaX(initializer.deltaX() ? initializer.deltaX() : negateIfPossible(initializer.wheelDeltaX()))
+    , m_deltaY(initializer.deltaY() ? initializer.deltaY() : negateIfPossible(initializer.wheelDeltaY()))
     , m_deltaZ(initializer.deltaZ())
     , m_deltaMode(initializer.deltaMode())
     , m_resendingPluginId(-1)