Prevent overflow of width/height of layout overflow rectangle which can cause scroll bar to misfunc…

Source/core/rendering/RenderOverflow.h

 /*
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 69 matching lines @@
 inline void RenderOverflow::move(LayoutUnit dx, LayoutUnit dy)
 {
     m_layoutOverflow.move(dx, dy);
     m_visualOverflow.move(dx, dy);
 }
 
 inline void RenderOverflow::addLayoutOverflow(const LayoutRect& rect)
 {
     LayoutUnit maxX = std::max(rect.maxX(), m_layoutOverflow.maxX());
     LayoutUnit maxY = std::max(rect.maxY(), m_layoutOverflow.maxY());
-    m_layoutOverflow.setX(std::min(rect.x(), m_layoutOverflow.x()));
-    m_layoutOverflow.setY(std::min(rect.y(), m_layoutOverflow.y()));
-    m_layoutOverflow.setWidth(maxX - m_layoutOverflow.x());
-    m_layoutOverflow.setHeight(maxY - m_layoutOverflow.y());
+    LayoutUnit minX = std::min(rect.x(), m_layoutOverflow.x());
+    LayoutUnit minY = std::min(rect.y(), m_layoutOverflow.y());
+    // In case of width/height overflow, fix the right/bottom edge and shift the top/left ones
+    if (minX < 0 && maxX >= 0 && minX + INT_MAX < maxX)

[eae, 2013/08/21 15:40:09]

I don't understand what this code is trying to do. LayoutUnits are saturated so
they cannot overflow, instead the value is clamped to the LayoutUnit::min/max
range. Furthermore mixing integers and LayoutUnits like this is a bad idea as
they have very different ranges and precision.

+        minX = maxX - INT_MAX;
+    if (minY < 0 && maxY >= 0 && minY + INT_MAX < maxY)
+        minY = maxY - INT_MAX;
+
+    m_layoutOverflow.setX(minX);
+    m_layoutOverflow.setY(minY);
+    m_layoutOverflow.setWidth(maxX - minX);
+    m_layoutOverflow.setHeight(maxY - minY);
 }
 
 inline void RenderOverflow::addVisualOverflow(const LayoutRect& rect)
 {
     LayoutUnit maxX = std::max(rect.maxX(), m_visualOverflow.maxX());
     LayoutUnit maxY = std::max(rect.maxY(), m_visualOverflow.maxY());
     m_visualOverflow.setX(std::min(rect.x(), m_visualOverflow.x()));
     m_visualOverflow.setY(std::min(rect.y(), m_visualOverflow.y()));
     m_visualOverflow.setWidth(maxX - m_visualOverflow.x());
     m_visualOverflow.setHeight(maxY - m_visualOverflow.y());
 }
 
 inline void RenderOverflow::setLayoutOverflow(const LayoutRect& rect)
 {
     m_layoutOverflow = rect;
 }
 
 inline void RenderOverflow::setVisualOverflow(const LayoutRect& rect)
 {
     m_visualOverflow = rect;
 }
 
 } // namespace WebCore
 
 #endif // RenderOverflow_h