GitLab

A clusterfuzz bug showed that the conversion from double to int could
lead to overflow while fetching the layout bounds in DomRect type and
converting it to WebRect. This patch follows a similar approach in
reporting the control bounds of the active element's bounding rect that
selection bounds does when it tries to update the selection bounds in
RenderWidget::UpdateSelectionBounds. We convert DOMRect to DoubleRect
and then use the enclosing IntRect to fetch the layout bounds using the
EnclosingIntRect API.

Bug: 1078429

Change-Id: Iac11e8f4ef1259214f100819f0d5df2f9b6d5356
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2183202
Commit-Queue: Anupam Snigdha <snianu@microsoft.com>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: danakj <danakj@chromium.org>
Cr-Commit-Position: refs/heads/master@{#766477}