Prevent overflow of width/height of layout overflow rectangle which can cause scroll bar to misfunc…

Source/core/rendering/RenderOverflow.h

 /*
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 69 matching lines @@
 inline void RenderOverflow::move(LayoutUnit dx, LayoutUnit dy)
 {
     m_layoutOverflow.move(dx, dy);
     m_visualOverflow.move(dx, dy);
 }
 
 inline void RenderOverflow::addLayoutOverflow(const LayoutRect& rect)
 {
     LayoutUnit maxX = std::max(rect.maxX(), m_layoutOverflow.maxX());
     LayoutUnit maxY = std::max(rect.maxY(), m_layoutOverflow.maxY());
-    m_layoutOverflow.setX(std::min(rect.x(), m_layoutOverflow.x()));
-    m_layoutOverflow.setY(std::min(rect.y(), m_layoutOverflow.y()));
-    m_layoutOverflow.setWidth(maxX - m_layoutOverflow.x());
-    m_layoutOverflow.setHeight(maxY - m_layoutOverflow.y());
+    LayoutUnit minX = std::min(rect.x(), m_layoutOverflow.x());
+    LayoutUnit minY = std::min(rect.y(), m_layoutOverflow.y());
+    // In case the width/height is larger than LayoutUnit can represent, fix the right/bottom edge and shift the top/left ones
+    m_layoutOverflow.setWidth(maxX - minX);
+    m_layoutOverflow.setHeight(maxY - minY);
+    m_layoutOverflow.setX(maxX - m_layoutOverflow.width());
+    m_layoutOverflow.setY(maxY - m_layoutOverflow.height());
 }
 
 inline void RenderOverflow::addVisualOverflow(const LayoutRect& rect)
 {
     LayoutUnit maxX = std::max(rect.maxX(), m_visualOverflow.maxX());
     LayoutUnit maxY = std::max(rect.maxY(), m_visualOverflow.maxY());
     m_visualOverflow.setX(std::min(rect.x(), m_visualOverflow.x()));
     m_visualOverflow.setY(std::min(rect.y(), m_visualOverflow.y()));
     m_visualOverflow.setWidth(maxX - m_visualOverflow.x());
     m_visualOverflow.setHeight(maxY - m_visualOverflow.y());
 }
 
 inline void RenderOverflow::setLayoutOverflow(const LayoutRect& rect)
 {
     m_layoutOverflow = rect;
 }
 
 inline void RenderOverflow::setVisualOverflow(const LayoutRect& rect)
 {
     m_visualOverflow = rect;
 }
 
 } // namespace WebCore
 
 #endif // RenderOverflow_h