Fix overflow/underflow in gfx geometry once and for all

ui/gfx/geometry/rect.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/gfx/geometry/rect.h"
 
 #include <algorithm>
 
 #if defined(OS_WIN)
 #include <windows.h>
@@ skipping 46 matching lines @@
 
 }  // namespace
 
 namespace gfx {
 
 void Rect::Inset(const Insets& insets) {
   Inset(insets.left(), insets.top(), insets.right(), insets.bottom());
 }
 
 void Rect::Inset(int left, int top, int right, int bottom) {
   origin_ += Vector2d(left, top);

[enne (OOO), 2016/09/21 00:48:24]

Adding and subtracting to vectors and points and such all can overflow as well,
so I probably need to go fix and test those before clusterfuzz figures it out.

-  set_width(std::max(width() - left - right, static_cast<int>(0)));
-  set_height(std::max(height() - top - bottom, static_cast<int>(0)));
+  // left+right might overflow/underflow, but width() - (left+right) might too.
+  set_width(SafeSubtract(width(), SafeAdd(left, right)));
+  set_height(SafeSubtract(height(), SafeAdd(top, bottom)));
 }
 
 void Rect::Offset(int horizontal, int vertical) {
   origin_ += Vector2d(horizontal, vertical);
   // Ensure that width and height remain valid.
   set_width(width());
   set_height(height());
 }
 
 void Rect::operator+=(const Vector2d& offset) {
@@ skipping 64 matching lines @@
     return;
   }
   if (rect.IsEmpty())
     return;
 
   int rx = std::min(x(), rect.x());
   int ry = std::min(y(), rect.y());
   int rr = std::max(right(), rect.right());
   int rb = std::max(bottom(), rect.bottom());
 
-  SetRect(rx, ry, rr - rx, rb - ry);
+  // Subtracting to get width/height might overflow integers, so clamp them.
+  SetRect(rx, ry, GetClampedWidthFromExtents(rx, rr),
+          GetClampedWidthFromExtents(ry, rb));
 }
 
 void Rect::Subtract(const Rect& rect) {
   if (!Intersects(rect))
     return;
   if (rect.Contains(*this)) {
     SetRect(0, 0, 0, 0);
     return;
   }
 
@@ skipping 125 matching lines @@
 
 Rect BoundingRect(const Point& p1, const Point& p2) {
   int rx = std::min(p1.x(), p2.x());
   int ry = std::min(p1.y(), p2.y());
   int rr = std::max(p1.x(), p2.x());
   int rb = std::max(p1.y(), p2.y());
   return Rect(rx, ry, rr - rx, rb - ry);
 }
 
 }  // namespace gfx