Fix integer overflow in ObjectPainter and divide by zero in Color.

third_party/WebKit/Source/core/paint/ObjectPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/ObjectPainter.h"
 
 #include "core/layout/LayoutBlock.h"
 #include "core/layout/LayoutInline.h"
 #include "core/layout/LayoutObject.h"
 #include "core/layout/LayoutTheme.h"
@@ skipping 42 matching lines @@
   // - needs a positive adjacent joint width (required by drawLineForBoxSide).
   // A counterclockwise joint:
   // - needs to increase the edge length to include the joint;
   // - needs a negative adjacent joint width (required by drawLineForBoxSide).
   switch (edge1.side) {
     case BSTop:
       switch (edge2.side) {
         case BSRight:  // Clockwise
           return outlineWidth;
         case BSLeft:  // Counterclockwise
-          edge1.x2 += outlineWidth;
-          edge2.y2 += outlineWidth;
+          edge1.x2 = saturatedAddition(edge1.x2, outlineWidth);
+          edge2.y2 = saturatedAddition(edge2.y2, outlineWidth);
           return -outlineWidth;
         default:  // Same side or no joint.
           return 0;
       }
     case BSRight:
       switch (edge2.side) {
         case BSBottom:  // Clockwise
           return outlineWidth;
         case BSTop:  // Counterclockwise
-          edge1.y2 += outlineWidth;
-          edge2.x1 -= outlineWidth;
+          edge1.y2 = saturatedAddition(edge1.y2, outlineWidth);
+          edge2.x1 = saturatedSubtraction(edge2.x1, outlineWidth);
           return -outlineWidth;
         default:  // Same side or no joint.
           return 0;
       }
     case BSBottom:
       switch (edge2.side) {
         case BSLeft:  // Clockwise
           return outlineWidth;
         case BSRight:  // Counterclockwise
-          edge1.x1 -= outlineWidth;
-          edge2.y1 -= outlineWidth;
+          edge1.x1 = saturatedSubtraction(edge1.x1, outlineWidth);
+          edge2.y1 = saturatedSubtraction(edge2.y1, outlineWidth);
           return -outlineWidth;
         default:  // Same side or no joint.
           return 0;
       }
     case BSLeft:
       switch (edge2.side) {
         case BSTop:  // Clockwise
           return outlineWidth;
         case BSBottom:  // Counterclockwise
-          edge1.y1 -= outlineWidth;
-          edge2.x2 += outlineWidth;
+          edge1.y1 = saturatedSubtraction(edge1.y1, outlineWidth);
+          edge2.x2 = saturatedAddition(edge2.x2, outlineWidth);
           return -outlineWidth;
         default:  // Same side or no joint.
           return 0;
       }
     default:
       ASSERT_NOT_REACHED();
       return 0;
   }
 }
 
@@ skipping 27 matching lines @@
       continue;
 
     edges.grow(++count);
     OutlineEdgeInfo& edge = edges.last();
     edge.x1 = SkScalarTruncToInt(points[0].x());
     edge.y1 = SkScalarTruncToInt(points[0].y());
     edge.x2 = SkScalarTruncToInt(points[1].x());
     edge.y2 = SkScalarTruncToInt(points[1].y());
     if (edge.x1 == edge.x2) {
       if (edge.y1 < edge.y2) {
-        edge.x1 -= width;
+        edge.x1 = saturatedSubtraction(edge.x1, width);
         edge.side = BSRight;
       } else {
         std::swap(edge.y1, edge.y2);
-        edge.x2 += width;
+        edge.x2 = saturatedAddition(edge.x2, width);
         edge.side = BSLeft;
       }
     } else {
       ASSERT(edge.y1 == edge.y2);
       if (edge.x1 < edge.x2) {
-        edge.y2 += width;
+        edge.y2 = saturatedAddition(edge.y2, width);
         edge.side = BSTop;
       } else {
         std::swap(edge.x1, edge.x2);
-        edge.y1 -= width;
+        edge.y1 = saturatedSubtraction(edge.y1, width);
         edge.side = BSBottom;
       }
     }
   }
 
   if (!count)
     return;
 
   Color outlineColor = color;
   bool useTransparencyLayer = color.hasAlpha();
@@ skipping 38 matching lines @@
   path.lineTo(quad[1]);
   path.lineTo(quad[2]);
   path.lineTo(quad[3]);
   SkPaint paint(context.fillPaint());
   paint.setAntiAlias(antialias);
   paint.setColor(color.rgb());
 
   context.drawPath(path, paint);
 }
 
+int thirdOfDouble(int width) {
+  return std::max((width * 2 + 1) / 3, 0);
+}
+
 }  // namespace
 
 void ObjectPainter::paintOutline(const PaintInfo& paintInfo,
                                  const LayoutPoint& paintOffset) {
   ASSERT(shouldPaintSelfOutline(paintInfo.phase));
 
   const ComputedStyle& styleToUse = m_layoutObject.styleRef();
   if (!styleToUse.hasOutline() ||
       styleToUse.visibility() != EVisibility::Visible)
     return;
@@ skipping 115 matching lines @@
                                        int y2,
                                        BoxSide side,
                                        Color color,
                                        EBorderStyle style,
                                        int adjacentWidth1,
                                        int adjacentWidth2,
                                        bool antialias) {
   int thickness;
   int length;
   if (side == BSTop || side == BSBottom) {
-    thickness = y2 - y1;
-    length = x2 - x1;
+    thickness = saturatedSubtraction(y2, y1);
+    length = saturatedSubtraction(x2, x1);
   } else {
-    thickness = x2 - x1;
-    length = y2 - y1;
+    thickness = saturatedSubtraction(x2, x1);
+    length = saturatedSubtraction(y2, y1);
   }
 
   // We would like this check to be an ASSERT as we don't want to draw empty
   // borders. However nothing guarantees that the following recursive calls to
   // drawLineForBoxSide will have positive thickness and length.
   if (length <= 0 || thickness <= 0)
     return;
 
   if (style == BorderStyleDouble && thickness < 3)
     style = BorderStyleSolid;
@@ skipping 50 matching lines @@
   StrokeStyle oldStrokeStyle = graphicsContext.getStrokeStyle();
   graphicsContext.setShouldAntialias(antialias);
   graphicsContext.setStrokeColor(color);
   graphicsContext.setStrokeThickness(thickness);
   graphicsContext.setStrokeStyle(style == BorderStyleDashed ? DashedStroke
                                                             : DottedStroke);
 
   switch (side) {
     case BSBottom:
     case BSTop: {
-      int midY = y1 + thickness / 2;
+      int midY = saturatedAddition(y1, thickness / 2);
       graphicsContext.drawLine(IntPoint(x1, midY), IntPoint(x2, midY));
       break;
     }
     case BSRight:
     case BSLeft: {
-      int midX = x1 + thickness / 2;
+      int midX = saturatedAddition(x1, thickness / 2);
       graphicsContext.drawLine(IntPoint(midX, y1), IntPoint(midX, y2));
       break;
     }
   }
   graphicsContext.setShouldAntialias(wasAntialiased);
   graphicsContext.setStrokeStyle(oldStrokeStyle);
 }
 
 void ObjectPainter::drawDoubleBoxSide(GraphicsContext& graphicsContext,
                                       int x1,
                                       int y1,
                                       int x2,
                                       int y2,
                                       int length,
                                       BoxSide side,
                                       Color color,
                                       int thickness,
                                       int adjacentWidth1,
                                       int adjacentWidth2,
                                       bool antialias) {
-  int thirdOfThickness = (thickness + 1) / 3;
+  int thirdOfThickness = saturatedAddition(thickness, 1) / 3;
   ASSERT(thirdOfThickness > 0);
 
   if (!adjacentWidth1 && !adjacentWidth2) {
     StrokeStyle oldStrokeStyle = graphicsContext.getStrokeStyle();
     graphicsContext.setStrokeStyle(NoStroke);
     graphicsContext.setFillColor(color);
 
     bool wasAntialiased = graphicsContext.shouldAntialias();
     graphicsContext.setShouldAntialias(antialias);
 
     switch (side) {
       case BSTop:
       case BSBottom:
         graphicsContext.drawRect(IntRect(x1, y1, length, thirdOfThickness));
         graphicsContext.drawRect(
-            IntRect(x1, y2 - thirdOfThickness, length, thirdOfThickness));
+            IntRect(x1, saturatedSubtraction(y2, thirdOfThickness), length,
+                    thirdOfThickness));
         break;
       case BSLeft:
       case BSRight:
         graphicsContext.drawRect(IntRect(x1, y1, thirdOfThickness, length));
         graphicsContext.drawRect(
-            IntRect(x2 - thirdOfThickness, y1, thirdOfThickness, length));
+            IntRect(saturatedSubtraction(x2, thirdOfThickness), y1,
+                    thirdOfThickness, length));
         break;
     }
 
     graphicsContext.setShouldAntialias(wasAntialiased);
     graphicsContext.setStrokeStyle(oldStrokeStyle);
     return;
   }
 
   int adjacent1BigThird =
-      ((adjacentWidth1 > 0) ? adjacentWidth1 + 1 : adjacentWidth1 - 1) / 3;
+      ((adjacentWidth1 > 0) ? saturatedAddition(adjacentWidth1, 1)
+                            : saturatedSubtraction(adjacentWidth1, 1)) /
+      3;
   int adjacent2BigThird =
-      ((adjacentWidth2 > 0) ? adjacentWidth2 + 1 : adjacentWidth2 - 1) / 3;
+      ((adjacentWidth2 > 0) ? saturatedAddition(adjacentWidth2, 1)
+                            : saturatedSubtraction(adjacentWidth2, 1)) /
+      3;
 
   switch (side) {
     case BSTop:
-      drawLineForBoxSide(graphicsContext,
-                         x1 + std::max((-adjacentWidth1 * 2 + 1) / 3, 0), y1,
-                         x2 - std::max((-adjacentWidth2 * 2 + 1) / 3, 0),
-                         y1 + thirdOfThickness, side, color, BorderStyleSolid,
-                         adjacent1BigThird, adjacent2BigThird, antialias);
       drawLineForBoxSide(
-          graphicsContext, x1 + std::max((adjacentWidth1 * 2 + 1) / 3, 0),
-          y2 - thirdOfThickness, x2 - std::max((adjacentWidth2 * 2 + 1) / 3, 0),
-          y2, side, color, BorderStyleSolid, adjacent1BigThird,
-          adjacent2BigThird, antialias);
+          graphicsContext,
+          saturatedAddition(x1, thirdOfDouble(-adjacentWidth1)), y1,
+          saturatedSubtraction(x2, thirdOfDouble(-adjacentWidth2)),
+          saturatedAddition(y1, thirdOfThickness), side, color,
+          BorderStyleSolid, adjacent1BigThird, adjacent2BigThird, antialias);
+      drawLineForBoxSide(
+          graphicsContext, saturatedAddition(x1, thirdOfDouble(adjacentWidth1)),
+          saturatedSubtraction(y2, thirdOfThickness),
+          saturatedSubtraction(x2, thirdOfDouble(adjacentWidth2)), y2, side,
+          color, BorderStyleSolid, adjacent1BigThird, adjacent2BigThird,
+          antialias);
       break;
     case BSLeft:
       drawLineForBoxSide(
-          graphicsContext, x1, y1 + std::max((-adjacentWidth1 * 2 + 1) / 3, 0),
-          x1 + thirdOfThickness,
-          y2 - std::max((-adjacentWidth2 * 2 + 1) / 3, 0), side, color,
+          graphicsContext, x1,
+          saturatedAddition(y1, thirdOfDouble(-adjacentWidth1)),
+          saturatedAddition(x1, thirdOfThickness),
+          saturatedSubtraction(y2, thirdOfDouble(-adjacentWidth2)), side, color,
           BorderStyleSolid, adjacent1BigThird, adjacent2BigThird, antialias);
-      drawLineForBoxSide(graphicsContext, x2 - thirdOfThickness,
-                         y1 + std::max((adjacentWidth1 * 2 + 1) / 3, 0), x2,
-                         y2 - std::max((adjacentWidth2 * 2 + 1) / 3, 0), side,
-                         color, BorderStyleSolid, adjacent1BigThird,
-                         adjacent2BigThird, antialias);
+      drawLineForBoxSide(
+          graphicsContext, saturatedSubtraction(x2, thirdOfThickness),
+          saturatedAddition(y1, thirdOfDouble(adjacentWidth1)), x2,
+          saturatedSubtraction(y2, thirdOfDouble(adjacentWidth2)), side, color,
+          BorderStyleSolid, adjacent1BigThird, adjacent2BigThird, antialias);
       break;
     case BSBottom:
-      drawLineForBoxSide(graphicsContext,
-                         x1 + std::max((adjacentWidth1 * 2 + 1) / 3, 0), y1,
-                         x2 - std::max((adjacentWidth2 * 2 + 1) / 3, 0),
-                         y1 + thirdOfThickness, side, color, BorderStyleSolid,
-                         adjacent1BigThird, adjacent2BigThird, antialias);
       drawLineForBoxSide(
-          graphicsContext, x1 + std::max((-adjacentWidth1 * 2 + 1) / 3, 0),
-          y2 - thirdOfThickness,
-          x2 - std::max((-adjacentWidth2 * 2 + 1) / 3, 0), y2, side, color,
+          graphicsContext, saturatedAddition(x1, thirdOfDouble(adjacentWidth1)),
+          y1, saturatedSubtraction(x2, thirdOfDouble(adjacentWidth2)),
+          saturatedAddition(y1, thirdOfThickness), side, color,
           BorderStyleSolid, adjacent1BigThird, adjacent2BigThird, antialias);
+      drawLineForBoxSide(
+          graphicsContext,
+          saturatedAddition(x1, thirdOfDouble(-adjacentWidth1)),
+          saturatedSubtraction(y2, thirdOfThickness),
+          saturatedSubtraction(x2, thirdOfDouble(-adjacentWidth2)), y2, side,
+          color, BorderStyleSolid, adjacent1BigThird, adjacent2BigThird,
+          antialias);
       break;
     case BSRight:
       drawLineForBoxSide(
-          graphicsContext, x1, y1 + std::max((adjacentWidth1 * 2 + 1) / 3, 0),
-          x1 + thirdOfThickness, y2 - std::max((adjacentWidth2 * 2 + 1) / 3, 0),
-          side, color, BorderStyleSolid, adjacent1BigThird, adjacent2BigThird,
-          antialias);
-      drawLineForBoxSide(graphicsContext, x2 - thirdOfThickness,
-                         y1 + std::max((-adjacentWidth1 * 2 + 1) / 3, 0), x2,
-                         y2 - std::max((-adjacentWidth2 * 2 + 1) / 3, 0), side,
-                         color, BorderStyleSolid, adjacent1BigThird,
-                         adjacent2BigThird, antialias);
+          graphicsContext, x1,
+          saturatedAddition(y1, thirdOfDouble(adjacentWidth1)),
+          saturatedAddition(x1, thirdOfThickness),
+          saturatedSubtraction(y2, thirdOfDouble(adjacentWidth2)), side, color,
+          BorderStyleSolid, adjacent1BigThird, adjacent2BigThird, antialias);
+      drawLineForBoxSide(
+          graphicsContext, saturatedSubtraction(x2, thirdOfThickness),
+          saturatedAddition(y1, thirdOfDouble(-adjacentWidth1)), x2,
+          saturatedSubtraction(y2, thirdOfDouble(-adjacentWidth2)), side, color,
+          BorderStyleSolid, adjacent1BigThird, adjacent2BigThird, antialias);
       break;
     default:
       break;
   }
 }
 
 void ObjectPainter::drawRidgeOrGrooveBoxSide(GraphicsContext& graphicsContext,
                                              int x1,
                                              int y1,
                                              int x2,
                                              int y2,
                                              BoxSide side,
                                              Color color,
                                              EBorderStyle style,
                                              int adjacentWidth1,
                                              int adjacentWidth2,
                                              bool antialias) {
   EBorderStyle s1;
   EBorderStyle s2;
   if (style == BorderStyleGroove) {
     s1 = BorderStyleInset;
     s2 = BorderStyleOutset;
   } else {
     s1 = BorderStyleOutset;
     s2 = BorderStyleInset;
   }
 
   int adjacent1BigHalf =
-      ((adjacentWidth1 > 0) ? adjacentWidth1 + 1 : adjacentWidth1 - 1) / 2;
+      ((adjacentWidth1 > 0) ? saturatedAddition(adjacentWidth1, 1)
+                            : saturatedSubtraction(adjacentWidth1, 1)) /
+      2;
   int adjacent2BigHalf =
-      ((adjacentWidth2 > 0) ? adjacentWidth2 + 1 : adjacentWidth2 - 1) / 2;
+      ((adjacentWidth2 > 0) ? saturatedAddition(adjacentWidth2, 1)
+                            : saturatedSubtraction(adjacentWidth2, 1)) /
+      2;
 
   switch (side) {
     case BSTop:
-      drawLineForBoxSide(graphicsContext, x1 + std::max(-adjacentWidth1, 0) / 2,
-                         y1, x2 - std::max(-adjacentWidth2, 0) / 2,
-                         (y1 + y2 + 1) / 2, side, color, s1, adjacent1BigHalf,
-                         adjacent2BigHalf, antialias);
       drawLineForBoxSide(
-          graphicsContext, x1 + std::max(adjacentWidth1 + 1, 0) / 2,
-          (y1 + y2 + 1) / 2, x2 - std::max(adjacentWidth2 + 1, 0) / 2, y2, side,
-          color, s2, adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
+          graphicsContext,
+          saturatedAddition(x1, std::max(-adjacentWidth1, 0) / 2), y1,
+          saturatedSubtraction(x2, std::max(-adjacentWidth2, 0) / 2),
+          saturatedAddition(y1, saturatedAddition(y2, 1)) / 2, side, color, s1,
+          adjacent1BigHalf, adjacent2BigHalf, antialias);
+      drawLineForBoxSide(
+          graphicsContext,
+          saturatedAddition(
+              x1, std::max(saturatedAddition(adjacentWidth1, 1), 0) / 2),
+          saturatedAddition(y1, saturatedAddition(y2, 1)) / 2,
+          saturatedSubtraction(
+              x2, std::max(saturatedAddition(adjacentWidth2, 1), 0) / 2),
+          y2, side, color, s2, adjacentWidth1 / 2, adjacentWidth2 / 2,
+          antialias);
       break;
     case BSLeft:
       drawLineForBoxSide(
-          graphicsContext, x1, y1 + std::max(-adjacentWidth1, 0) / 2,
-          (x1 + x2 + 1) / 2, y2 - std::max(-adjacentWidth2, 0) / 2, side, color,
-          s1, adjacent1BigHalf, adjacent2BigHalf, antialias);
-      drawLineForBoxSide(graphicsContext, (x1 + x2 + 1) / 2,
-                         y1 + std::max(adjacentWidth1 + 1, 0) / 2, x2,
-                         y2 - std::max(adjacentWidth2 + 1, 0) / 2, side, color,
-                         s2, adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
+          graphicsContext, x1,
+          saturatedAddition(y1, std::max(-adjacentWidth1, 0) / 2),
+          saturatedAddition(x1, saturatedAddition(x2, 1)) / 2,
+          saturatedSubtraction(y2, std::max(-adjacentWidth2, 0) / 2), side,
+          color, s1, adjacent1BigHalf, adjacent2BigHalf, antialias);
+      drawLineForBoxSide(
+          graphicsContext, saturatedAddition(x1, saturatedAddition(x2, 1)) / 2,
+          saturatedAddition(
+              y1, std::max(saturatedAddition(adjacentWidth1, 1), 0) / 2),
+          x2, saturatedSubtraction(
+                  y2, std::max(saturatedAddition(adjacentWidth2, 1), 0) / 2),
+          side, color, s2, adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
       break;
     case BSBottom:
-      drawLineForBoxSide(graphicsContext, x1 + std::max(adjacentWidth1, 0) / 2,
-                         y1, x2 - std::max(adjacentWidth2, 0) / 2,
-                         (y1 + y2 + 1) / 2, side, color, s2, adjacent1BigHalf,
-                         adjacent2BigHalf, antialias);
       drawLineForBoxSide(
-          graphicsContext, x1 + std::max(-adjacentWidth1 + 1, 0) / 2,
-          (y1 + y2 + 1) / 2, x2 - std::max(-adjacentWidth2 + 1, 0) / 2, y2,
-          side, color, s1, adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
+          graphicsContext,
+          saturatedAddition(x1, std::max(adjacentWidth1, 0) / 2), y1,
+          saturatedSubtraction(x2, std::max(adjacentWidth2, 0) / 2),
+          saturatedAddition(y1, saturatedAddition(y2, 1)) / 2, side, color, s2,
+          adjacent1BigHalf, adjacent2BigHalf, antialias);
+      drawLineForBoxSide(
+          graphicsContext,
+          saturatedAddition(
+              x1, std::max(saturatedAddition(-adjacentWidth1, 1), 0) / 2),
+          saturatedAddition(y1, saturatedAddition(y2, 1)) / 2,
+          saturatedSubtraction(
+              x2, std::max(saturatedAddition(-adjacentWidth2, 1), 0) / 2),
+          y2, side, color, s1, adjacentWidth1 / 2, adjacentWidth2 / 2,
+          antialias);
       break;
     case BSRight:
       drawLineForBoxSide(
-          graphicsContext, x1, y1 + std::max(adjacentWidth1, 0) / 2,
-          (x1 + x2 + 1) / 2, y2 - std::max(adjacentWidth2, 0) / 2, side, color,
-          s2, adjacent1BigHalf, adjacent2BigHalf, antialias);
-      drawLineForBoxSide(graphicsContext, (x1 + x2 + 1) / 2,
-                         y1 + std::max(-adjacentWidth1 + 1, 0) / 2, x2,
-                         y2 - std::max(-adjacentWidth2 + 1, 0) / 2, side, color,
-                         s1, adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
+          graphicsContext, x1,
+          saturatedAddition(y1, std::max(adjacentWidth1, 0) / 2),
+          saturatedAddition(x1, saturatedAddition(x2, 1)) / 2,
+          saturatedSubtraction(y2, std::max(adjacentWidth2, 0) / 2), side,
+          color, s2, adjacent1BigHalf, adjacent2BigHalf, antialias);
+      drawLineForBoxSide(
+          graphicsContext, saturatedAddition(x1, saturatedAddition(x2, 1)) / 2,
+          saturatedAddition(
+              y1, std::max(saturatedAddition(-adjacentWidth1, 1), 0) / 2),
+          x2, saturatedSubtraction(
+                  y2, std::max(saturatedAddition(-adjacentWidth2, 1), 0) / 2),
+          side, color, s1, adjacentWidth1 / 2, adjacentWidth2 / 2, antialias);
       break;
   }
 }
 
 void ObjectPainter::drawSolidBoxSide(GraphicsContext& graphicsContext,
                                      int x1,
                                      int y1,
                                      int x2,
                                      int y2,
                                      BoxSide side,
                                      Color color,
                                      int adjacentWidth1,
                                      int adjacentWidth2,
                                      bool antialias) {
   ASSERT(x2 >= x1);
   ASSERT(y2 >= y1);
 
   if (!adjacentWidth1 && !adjacentWidth2) {
     // Tweak antialiasing to match the behavior of fillQuad();
     // this matters for rects in transformed contexts.
     bool wasAntialiased = graphicsContext.shouldAntialias();
     if (antialias != wasAntialiased)
       graphicsContext.setShouldAntialias(antialias);
-    graphicsContext.fillRect(IntRect(x1, y1, x2 - x1, y2 - y1), color);
+    graphicsContext.fillRect(IntRect(x1, y1, saturatedSubtraction(x2, x1),
+                                     saturatedSubtraction(y2, y1)),
+                             color);
     if (antialias != wasAntialiased)
       graphicsContext.setShouldAntialias(wasAntialiased);
     return;
   }
 
   FloatPoint quad[4];
   switch (side) {
     case BSTop:
-      quad[0] = FloatPoint(x1 + std::max(-adjacentWidth1, 0), y1);
-      quad[1] = FloatPoint(x1 + std::max(adjacentWidth1, 0), y2);
-      quad[2] = FloatPoint(x2 - std::max(adjacentWidth2, 0), y2);
-      quad[3] = FloatPoint(x2 - std::max(-adjacentWidth2, 0), y1);
+      quad[0] =
+          FloatPoint(saturatedAddition(x1, std::max(-adjacentWidth1, 0)), y1);
+      quad[1] =
+          FloatPoint(saturatedAddition(x1, std::max(adjacentWidth1, 0)), y2);
+      quad[2] =
+          FloatPoint(saturatedSubtraction(x2, std::max(adjacentWidth2, 0)), y2);
+      quad[3] = FloatPoint(
+          saturatedSubtraction(x2, std::max(-adjacentWidth2, 0)), y1);
       break;
     case BSBottom:
-      quad[0] = FloatPoint(x1 + std::max(adjacentWidth1, 0), y1);
-      quad[1] = FloatPoint(x1 + std::max(-adjacentWidth1, 0), y2);
-      quad[2] = FloatPoint(x2 - std::max(-adjacentWidth2, 0), y2);
-      quad[3] = FloatPoint(x2 - std::max(adjacentWidth2, 0), y1);
+      quad[0] =
+          FloatPoint(saturatedAddition(x1, std::max(adjacentWidth1, 0)), y1);
+      quad[1] =
+          FloatPoint(saturatedAddition(x1, std::max(-adjacentWidth1, 0)), y2);
+      quad[2] = FloatPoint(
+          saturatedSubtraction(x2, std::max(-adjacentWidth2, 0)), y2);
+      quad[3] =
+          FloatPoint(saturatedSubtraction(x2, std::max(adjacentWidth2, 0)), y1);
       break;
     case BSLeft:
-      quad[0] = FloatPoint(x1, y1 + std::max(-adjacentWidth1, 0));
-      quad[1] = FloatPoint(x1, y2 - std::max(-adjacentWidth2, 0));
-      quad[2] = FloatPoint(x2, y2 - std::max(adjacentWidth2, 0));
-      quad[3] = FloatPoint(x2, y1 + std::max(adjacentWidth1, 0));
+      quad[0] =
+          FloatPoint(x1, saturatedAddition(y1, std::max(-adjacentWidth1, 0)));
+      quad[1] = FloatPoint(
+          x1, saturatedSubtraction(y2, std::max(-adjacentWidth2, 0)));
+      quad[2] =
+          FloatPoint(x2, saturatedSubtraction(y2, std::max(adjacentWidth2, 0)));
+      quad[3] =
+          FloatPoint(x2, saturatedAddition(y1, std::max(adjacentWidth1, 0)));
       break;
     case BSRight:
-      quad[0] = FloatPoint(x1, y1 + std::max(adjacentWidth1, 0));
-      quad[1] = FloatPoint(x1, y2 - std::max(adjacentWidth2, 0));
-      quad[2] = FloatPoint(x2, y2 - std::max(-adjacentWidth2, 0));
-      quad[3] = FloatPoint(x2, y1 + std::max(-adjacentWidth1, 0));
+      quad[0] =
+          FloatPoint(x1, saturatedAddition(y1, std::max(adjacentWidth1, 0)));
+      quad[1] =
+          FloatPoint(x1, saturatedSubtraction(y2, std::max(adjacentWidth2, 0)));
+      quad[2] = FloatPoint(
+          x2, saturatedSubtraction(y2, std::max(-adjacentWidth2, 0)));
+      quad[3] =
+          FloatPoint(x2, saturatedAddition(y1, std::max(-adjacentWidth1, 0)));
       break;
   }
 
   fillQuad(graphicsContext, quad, color, antialias);
 }
 
 void ObjectPainter::paintAllPhasesAtomically(const PaintInfo& paintInfo,
                                              const LayoutPoint& paintOffset) {
   // Pass PaintPhaseSelection and PaintPhaseTextClip to the descendants so that
   // they will paint for selection and text clip respectively. We don't need
@@ skipping 12 matching lines @@
   m_layoutObject.paint(info, paintOffset);
   info.phase = PaintPhaseFloat;
   m_layoutObject.paint(info, paintOffset);
   info.phase = PaintPhaseForeground;
   m_layoutObject.paint(info, paintOffset);
   info.phase = PaintPhaseOutline;
   m_layoutObject.paint(info, paintOffset);
 }
 
 }  // namespace blink