Avoid negative content box sizes.

third_party/WebKit/Source/core/layout/LayoutBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc.
  *               All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 491 matching lines @@
     child = child->nextSibling();
   }
   invalidateBackgroundObscurationStatus();
   clearNeedsLayout();
 }
 
 // More IE extensions.  clientWidth and clientHeight represent the interior of
 // an object excluding border and scrollbar.
 DISABLE_CFI_PERF
 LayoutUnit LayoutBox::clientWidth() const {
-  return m_frameRect.width() - borderLeft() - borderRight() -
-         verticalScrollbarWidth();
+  // We need to guard against ill effects of saturated arithmetic here. The sum
+  // of the two border sides may be larger than the border box size stored in

[mstensho (USE GERRIT), 2017/02/23 13:35:09]

This was true when I started working on this patch, but it's no longer the case.
With https://codereview.chromium.org/2640143005 border sides are now limited to
2^20px , while LayoutUnit values are limited to +/- 2^25px, so subtracting
borders should no longer result in LayoutUnit saturation.

However, I still believe we should keep my change as it is, because:

1: We need to guard against the scrollbar being wider than the padding box
anyway.
2: Some time in the future, we might start to allow larger border values than
today

[eae, 2017/02/23 15:54:37]

Fully agree that we should keep the check. Please update the comment to reflect
the current state of the world though.

Thanks for staying on top of things!

[mstensho (USE GERRIT), 2017/02/23 17:42:08]

Good idea! Done.

+  // m_frameRect (since they are all LayoutUnit values). Furthermore, the
+  // scrollbar may be wider than the padding box.
+  return (m_frameRect.width() - borderLeft() - borderRight() -
+          verticalScrollbarWidth())
+      .clampNegativeToZero();
 }
 
 DISABLE_CFI_PERF
 LayoutUnit LayoutBox::clientHeight() const {
-  return m_frameRect.height() - borderTop() - borderBottom() -
-         horizontalScrollbarHeight();
+  // We need to guard against ill effects of saturated arithmetic here. The sum
+  // of the two border sides may be larger than the border box size stored in
+  // m_frameRect (since they are all LayoutUnit values). Furthermore, the
+  // scrollbar may be wider than the padding box.
+  return (m_frameRect.height() - borderTop() - borderBottom() -
+          horizontalScrollbarHeight())
+      .clampNegativeToZero();
 }
 
 int LayoutBox::pixelSnappedClientWidth() const {
   return snapSizeToPixel(clientWidth(), location().x() + clientLeft());
 }
 
 DISABLE_CFI_PERF
 int LayoutBox::pixelSnappedClientHeight() const {
   return snapSizeToPixel(clientHeight(), location().y() + clientTop());
 }
@@ skipping 5185 matching lines @@
     block->adjustChildDebugRect(rect);
 
   return rect;
 }
 
 bool LayoutBox::shouldClipOverflow() const {
   return hasOverflowClip() || styleRef().containsPaint() || hasControlClip();
 }
 
 }  // namespace blink