Fix integer size overflow crash.

Clamped the values in |ConvertRectToScreen| to avoid integer overflow
while calculating the width/height of the rectangle.

Bug: 1134463
Change-Id: Ic53a8513be7393b0e58ee9d3b2019a0b71c9d703
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2450920Reviewed-by: Avi Drissman <avi@chromium.org>
Commit-Queue: Anupam Snigdha <snianu@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#813890}

content/browser/renderer_host/render_widget_host_view_aura.cc

@@ -1238,10 +1238,8 @@ gfx::Rect RenderWidgetHostViewAura::ConvertRectToScreen(
     return rect;
   screen_position_client->ConvertPointToScreen(window_, &origin);
   screen_position_client->ConvertPointToScreen(window_, &end);
-  return gfx::Rect(origin.x(),
-                   origin.y(),
-                   end.x() - origin.x(),
-                   end.y() - origin.y());
+  return gfx::Rect(origin.x(), origin.y(), base::ClampSub(end.x(), origin.x()),
+                   base::ClampSub(end.y(), origin.y()));
 }
 
 gfx::Rect RenderWidgetHostViewAura::ConvertRectFromScreen(