Avoid negative content box sizes.

third_party/WebKit/Source/core/layout/LayoutBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc.
  *               All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 491 matching lines @@
     child = child->nextSibling();
   }
   invalidateBackgroundObscurationStatus();
   clearNeedsLayout();
 }
 
 // More IE extensions.  clientWidth and clientHeight represent the interior of
 // an object excluding border and scrollbar.
 DISABLE_CFI_PERF
 LayoutUnit LayoutBox::clientWidth() const {
-  return m_frameRect.width() - borderLeft() - borderRight() -
-         verticalScrollbarWidth();
+  // We need to clamp negative values. The scrollbar may be wider than the
+  // padding box. Another reason: While border side values are currently limited
+  // to 2^20px (a recent change in the code), if this limit is raised again in
+  // the future, we'd have ill effects of saturated arithmetic otherwise.
+  return (m_frameRect.width() - borderLeft() - borderRight() -
+          verticalScrollbarWidth())
+      .clampNegativeToZero();
 }
 
 DISABLE_CFI_PERF
 LayoutUnit LayoutBox::clientHeight() const {
-  return m_frameRect.height() - borderTop() - borderBottom() -
-         horizontalScrollbarHeight();
+  // We need to clamp negative values. The scrollbar may be wider than the
+  // padding box. Another reason: While border side values are currently limited
+  // to 2^20px (a recent change in the code), if this limit is raised again in
+  // the future, we'd have ill effects of saturated arithmetic otherwise.
+  return (m_frameRect.height() - borderTop() - borderBottom() -
+          horizontalScrollbarHeight())
+      .clampNegativeToZero();
 }
 
 int LayoutBox::pixelSnappedClientWidth() const {
   return snapSizeToPixel(clientWidth(), location().x() + clientLeft());
 }
 
 DISABLE_CFI_PERF
 int LayoutBox::pixelSnappedClientHeight() const {
   return snapSizeToPixel(clientHeight(), location().y() + clientTop());
 }
@@ skipping 5185 matching lines @@
     block->adjustChildDebugRect(rect);
 
   return rect;
 }
 
 bool LayoutBox::shouldClipOverflow() const {
   return hasOverflowClip() || styleRef().containsPaint() || hasControlClip();
 }
 
 }  // namespace blink