Fix overflow/underflow in gfx geometry once and for all

ui/gfx/geometry/rect.cc

Index: ui/gfx/geometry/rect.cc
diff --git a/ui/gfx/geometry/rect.cc b/ui/gfx/geometry/rect.cc
index 2a78d0b5c6e3696adeee8d5ffffa32b034e819f9..9bbee19cfb099f893668ba7871d11321e4fa31b7 100644
--- a/ui/gfx/geometry/rect.cc
+++ b/ui/gfx/geometry/rect.cc
@@ -65,8 +65,9 @@ void Rect::Inset(const Insets& insets) {
 
 void Rect::Inset(int left, int top, int right, int bottom) {
   origin_ += Vector2d(left, top);

[enne (OOO), 2016/09/21 00:48:24]

Adding and subtracting to vectors and points and such all can overflow as well,
so I probably need to go fix and test those before clusterfuzz figures it out.

-  set_width(std::max(width() - left - right, static_cast<int>(0)));
-  set_height(std::max(height() - top - bottom, static_cast<int>(0)));
+  // left+right might overflow/underflow, but width() - (left+right) might too.
+  set_width(SafeSubtract(width(), SafeAdd(left, right)));
+  set_height(SafeSubtract(height(), SafeAdd(top, bottom)));
 }
 
 void Rect::Offset(int horizontal, int vertical) {
@@ -151,7 +152,9 @@ void Rect::Union(const Rect& rect) {
   int rr = std::max(right(), rect.right());
   int rb = std::max(bottom(), rect.bottom());
 
-  SetRect(rx, ry, rr - rx, rb - ry);
+  // Subtracting to get width/height might overflow integers, so clamp them.
+  SetRect(rx, ry, GetClampedWidthFromExtents(rx, rr),
+          GetClampedWidthFromExtents(ry, rb));
 }
 
 void Rect::Subtract(const Rect& rect) {