Avoid negative content box sizes.

third_party/WebKit/Source/core/layout/LayoutBox.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2006, 2007 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 473 matching lines @@
   void addOverflowFromChild(LayoutBox* child) {
     addOverflowFromChild(child, child->locationOffset());
   }
   void addOverflowFromChild(LayoutBox* child, const LayoutSize& delta);
   void clearLayoutOverflow();
   void clearAllOverflows() { m_overflow.reset(); }
 
   void updateLayerTransformAfterLayout();
 
   DISABLE_CFI_PERF LayoutUnit contentWidth() const {
-    return clientWidth() - paddingLeft() - paddingRight();
+    // We're dealing with LayoutUnit and saturated arithmetic here, so we need
+    // to guard against negative results. The value returned from clientWidth()
+    // may in itself be a victim of saturated arithmetic; e.g. if both border
+    // sides were sufficiently wide (close to LayoutUnit::max()).  Here we
+    // subtract two padding values from that result, which is another source of
+    // saturated arithmetic.
+    return (clientWidth() - paddingLeft() - paddingRight())
+        .clampNegativeToZero();
   }
   DISABLE_CFI_PERF LayoutUnit contentHeight() const {
-    return clientHeight() - paddingTop() - paddingBottom();
+    // We're dealing with LayoutUnit and saturated arithmetic here, so we need
+    // to guard against negative results. The value returned from clientHeight()
+    // may in itself be a victim of saturated arithmetic; e.g. if both border
+    // sides were sufficiently wide (close to LayoutUnit::max()).  Here we
+    // subtract two padding values from that result, which is another source of
+    // saturated arithmetic.
+    return (clientHeight() - paddingTop() - paddingBottom())
+        .clampNegativeToZero();
   }
   LayoutSize contentSize() const {
     return LayoutSize(contentWidth(), contentHeight());
   }
   LayoutUnit contentLogicalWidth() const {
     return style()->isHorizontalWritingMode() ? contentWidth()
                                               : contentHeight();
   }
   LayoutUnit contentLogicalHeight() const {
     return style()->isHorizontalWritingMode() ? contentHeight()
@@ skipping 1145 matching lines @@
          breakValue == EBreakBetween::kLeft ||
          breakValue == EBreakBetween::kPage ||
          breakValue == EBreakBetween::kRecto ||
          breakValue == EBreakBetween::kRight ||
          breakValue == EBreakBetween::kVerso;
 }
 
 }  // namespace blink
 
 #endif  // LayoutBox_h