b=810274 ensure scrolled range is non-negative even in the presence of nscoord overflow r=roc

Instead of trying to detect all integer overflow at the source, this merely
keeps the sizes non-negative.  That may not mean they are less than
nscoord_MAX.

If we give in and accept that integer arithmetic may result in the scrolled
rect being smaller than the scroll port, then we shouldn't assert.

--HG--
extra : transplant_source : RP%15%84zx%B9%E8%2C%1E%0A%AB%82%F4%9C%A2y%AD5%27

layout/generic/crashtests/crashtests.list

@@ -24,7 +24,7 @@ load 321224.xul
 load 322780-1.xul
 load 323381-1.html
 load 323381-2.html
-asserts-if(gtk2Widget,14-15) load 323386-1.html # Bug 575011
+asserts-if(gtk2Widget,5) load 323386-1.html # Bug 575011
 load 323389-1.html
 load 323389-2.html
 load 323493-1.html
@@ -306,8 +306,8 @@ load 465651-1.html
 load 467137-1.html
 load 467213-1.html
 load 467487-1.html
-asserts(6-10) load 467493-1.html
-asserts(4-9) load 467493-2.html
+load 467493-1.html
+load 467493-2.html
 load 467875-1.xhtml
 load 467914-1.html
 load 468207-1.html
@@ -375,8 +375,8 @@ load 534366-2.html
 load 536692-1.xhtml
 load 541277-1.html
 load 541277-2.html
-asserts(3) load 541714-1.html
-asserts(3-8) load 541714-2.html
+load 541714-1.html
+load 541714-2.html
 load 542136-1.html
 load 545571-1.html
 load 547338.xul

layout/generic/nsGfxScrollFrame.cpp

@@ -2309,8 +2309,8 @@ nsRect
 nsGfxScrollFrameInner::GetScrollRange(nscoord aWidth, nscoord aHeight) const
 {
   nsRect range = GetScrolledRect();
-  range.width -= aWidth;
-  range.height -= aHeight;
+  range.width = std::max(range.width - aWidth, 0);
+  range.height = std::max(range.height - aHeight, 0);
   return range;
 }
 
@@ -3898,10 +3898,12 @@ nsGfxScrollFrameInner::GetScrolledRect() const
     GetScrolledRectInternal(mScrolledFrame->GetScrollableOverflowRect(),
                             mScrollPort.Size());
 
-  NS_ASSERTION(result.width >= mScrollPort.width,
-               "Scrolled rect smaller than scrollport?");
-  NS_ASSERTION(result.height >= mScrollPort.height,
-               "Scrolled rect smaller than scrollport?");
+  if (result.width < mScrollPort.width) {
+    NS_WARNING("Scrolled rect smaller than scrollport?");
+  }
+  if (result.height < mScrollPort.height) {
+    NS_WARNING("Scrolled rect smaller than scrollport?");
+  }
   return result;
 }
 

layout/reftests/bugs/reftest.list

@@ -1570,7 +1570,7 @@ skip-if(B2G) fails-if(Android) random-if(layersGPUAccelerated) fails-if(/^Window
 == 582037-1b.html 582037-1-ref.html
 skip-if(B2G) == 582037-2a.html 582037-2-ref.html
 skip-if(B2G) == 582037-2b.html 582037-2-ref.html
-asserts(0-13) == 582146-1.html about:blank
+asserts(2) == 582146-1.html about:blank
 skip-if(B2G) == 582476-1.svg 582476-1-ref.svg
 == 584400-dash-length.svg 584400-dash-length-ref.svg
 == 584699-1.html 584699-1-ref.html