Bug 1707720 - Use saturating addition for math-depth. r=fredw

Differential Revision: https://phabricator.services.mozilla.com/D114070

servo/components/style/values/computed/font.rs

@@ -828,14 +828,14 @@ impl ToComputedValue for specified::MathDepth {
                 let parent = cx.builder.get_parent_font().clone_math_depth() as i32;
                 let style = cx.builder.get_parent_font().clone_math_style();
                 if style == MathStyleValue::Compact {
-                    parent + 1
+                    parent.saturating_add(1)
                 } else {
                     parent
                 }
             },
             specified::MathDepth::Add(rel) => {
                 let parent = cx.builder.get_parent_font().clone_math_depth();
-                parent as i32 + rel.to_computed_value(cx)
+                (parent as i32).saturating_add(rel.to_computed_value(cx))
             },
             specified::MathDepth::Absolute(abs) => abs.to_computed_value(cx),
         };

testing/web-platform/tests/mathml/crashtests/math-depth-overflow.html

@@ -0,0 +1,10 @@
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  let a = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'math')
+  a.setAttribute('scriptlevel', '127')
+  let b = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'mstyle')
+  b.setAttribute('scriptlevel', '+2147483645')
+  a.appendChild(b)
+  document.documentElement.appendChild(a)
+})
+</script>