Avoid negative content box sizes.

third_party/WebKit/Source/core/layout/LayoutBox.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBox.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.cpp b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
index 0f73e71f2bfdf2ea81033d14418d0ec145e8998f..d0c50bb6557254eca3fd3ada191fc8a19f6ba0c6 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
@@ -509,14 +509,24 @@ void LayoutBox::layout() {
 // an object excluding border and scrollbar.
 DISABLE_CFI_PERF
 LayoutUnit LayoutBox::clientWidth() const {
-  return m_frameRect.width() - borderLeft() - borderRight() -
-         verticalScrollbarWidth();
+  // We need to guard against ill effects of saturated arithmetic here. The sum
+  // of the two border sides may be larger than the border box size stored in

[mstensho (USE GERRIT), 2017/02/23 13:35:09]

This was true when I started working on this patch, but it's no longer the case.
With https://codereview.chromium.org/2640143005 border sides are now limited to
2^20px , while LayoutUnit values are limited to +/- 2^25px, so subtracting
borders should no longer result in LayoutUnit saturation.

However, I still believe we should keep my change as it is, because:

1: We need to guard against the scrollbar being wider than the padding box
anyway.
2: Some time in the future, we might start to allow larger border values than
today

[eae, 2017/02/23 15:54:37]

Fully agree that we should keep the check. Please update the comment to reflect
the current state of the world though.

Thanks for staying on top of things!

[mstensho (USE GERRIT), 2017/02/23 17:42:08]

Good idea! Done.

+  // m_frameRect (since they are all LayoutUnit values). Furthermore, the
+  // scrollbar may be wider than the padding box.
+  return (m_frameRect.width() - borderLeft() - borderRight() -
+          verticalScrollbarWidth())
+      .clampNegativeToZero();
 }
 
 DISABLE_CFI_PERF
 LayoutUnit LayoutBox::clientHeight() const {
-  return m_frameRect.height() - borderTop() - borderBottom() -
-         horizontalScrollbarHeight();
+  // We need to guard against ill effects of saturated arithmetic here. The sum
+  // of the two border sides may be larger than the border box size stored in
+  // m_frameRect (since they are all LayoutUnit values). Furthermore, the
+  // scrollbar may be wider than the padding box.
+  return (m_frameRect.height() - borderTop() - borderBottom() -
+          horizontalScrollbarHeight())
+      .clampNegativeToZero();
 }
 
 int LayoutBox::pixelSnappedClientWidth() const {