Prevent overflow of width/height of layout overflow rectangle which can cause scroll bar to misfunc…

Source/core/rendering/RenderOverflow.h

Index: Source/core/rendering/RenderOverflow.h
diff --git a/Source/core/rendering/RenderOverflow.h b/Source/core/rendering/RenderOverflow.h
index d01d3bae59190896538aa3546b2442e393dd8fde..a3cd54c226583e1161e175ed7256dd96502c5d80 100644
--- a/Source/core/rendering/RenderOverflow.h
+++ b/Source/core/rendering/RenderOverflow.h
@@ -87,10 +87,18 @@ inline void RenderOverflow::addLayoutOverflow(const LayoutRect& rect)
 {
     LayoutUnit maxX = std::max(rect.maxX(), m_layoutOverflow.maxX());
     LayoutUnit maxY = std::max(rect.maxY(), m_layoutOverflow.maxY());
-    m_layoutOverflow.setX(std::min(rect.x(), m_layoutOverflow.x()));
-    m_layoutOverflow.setY(std::min(rect.y(), m_layoutOverflow.y()));
-    m_layoutOverflow.setWidth(maxX - m_layoutOverflow.x());
-    m_layoutOverflow.setHeight(maxY - m_layoutOverflow.y());
+    LayoutUnit minX = std::min(rect.x(), m_layoutOverflow.x());
+    LayoutUnit minY = std::min(rect.y(), m_layoutOverflow.y());
+    // In case of width/height overflow, fix the right/bottom edge and shift the top/left ones
+    if (minX < 0 && maxX >= 0 && minX + INT_MAX < maxX)

[eae, 2013/08/21 15:40:09]

I don't understand what this code is trying to do. LayoutUnits are saturated so
they cannot overflow, instead the value is clamped to the LayoutUnit::min/max
range. Furthermore mixing integers and LayoutUnits like this is a bad idea as
they have very different ranges and precision.

+        minX = maxX - INT_MAX;
+    if (minY < 0 && maxY >= 0 && minY + INT_MAX < maxY)
+        minY = maxY - INT_MAX;
+
+    m_layoutOverflow.setX(minX);
+    m_layoutOverflow.setY(minY);
+    m_layoutOverflow.setWidth(maxX - minX);
+    m_layoutOverflow.setHeight(maxY - minY);
 }
 
 inline void RenderOverflow::addVisualOverflow(const LayoutRect& rect)