Prevent integer overflows in ANPlusB handling

third_party/WebKit/Source/core/css/CSSSelectorTest.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/CSSTestHelper.h"
 #include "core/css/RuleSet.h"
 
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
@@ skipping 36 matching lines @@
       ".a.b .c {}";
 
   helper.AddCSSRules(css_rules);
   EXPECT_EQ(30u,
             helper.GetRuleSet().RuleCount());  // .a, .b counts as two rules.
 #ifndef NDEBUG
   helper.GetRuleSet().Show();
 #endif
 }
 
+TEST(CSSSelector, OverflowRareDataMatchNth) {
+  int max_int = std::numeric_limits<int>::max();
+  int min_int = std::numeric_limits<int>::min();
+  CSSSelector selector;
+
+  // Overflow count - b (max_int - -1 = max_int + 1)
+  selector.SetNth(1, -1);
+  EXPECT_FALSE(selector.MatchNth(max_int));
+  // 0 - (min_int) = max_int + 1
+  selector.SetNth(1, min_int);
+  EXPECT_FALSE(selector.MatchNth(0));
+
+  // min_int - 1
+  selector.SetNth(-1, min_int);
+  EXPECT_FALSE(selector.MatchNth(1));
+
+  // a shouldn't negate to itself (and min_int negates to itself).
+  // Note: This test can only fail when using ubsan.
+  selector.SetNth(min_int, 10);
+  EXPECT_FALSE(selector.MatchNth(2));
+}
+
 }  // namespace blink