Fix abspos DCHECK crash

Bug: 740993
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_layout_ng
Change-Id: I88816900bd0b55b6b6d8c5b139a2819ebfa1a9a3
Reviewed-on: https://chromium-review.googlesource.com/963510Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Commit-Queue: Aleks Totic <atotic@chromium.org>
Cr-Commit-Position: refs/heads/master@{#543236}

third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG

@@ -3400,7 +3400,6 @@ crbug.com/591099 printing/thead-repeats-at-top-of-each-page.html [ Failure ]
 crbug.com/591099 printing/thead-under-multicol.html [ Failure ]
 crbug.com/591099 scrollbars/auto-scrollbar-fit-content.html [ Failure ]
 crbug.com/591099 scrollbars/custom-scrollbar-with-incomplete-style.html [ Failure ]
-crbug.com/591099 scrollbars/scrollbar-large-overflow-rectangle.html [ Crash ]
 crbug.com/591099 scrollbars/scrollbar-miss-mousemove-disabled.html [ Failure ]
 crbug.com/714962 scrollbars/scrollbar-orientation.html [ Failure ]
 crbug.com/714962 scrollbars/scrollbar-position-crash.html [ Crash ]

third_party/WebKit/Source/core/layout/ng/ng_absolute_utils.cc

@@ -263,10 +263,10 @@ void ComputeAbsoluteHorizontal(const NGConstraintSpace& space,
   // Rules 4 through 6, 1 out of 3 are unknown.
   if (!left) {
     left =
-        container_size.width - *right - *width - *margin_left - *margin_right;
+        container_size.width - *width - *right - *margin_left - *margin_right;
   } else if (!right) {
     right =
-        container_size.width - *left - *width - *margin_left - *margin_right;
+        container_size.width - *width - *left - *margin_left - *margin_right;
   } else if (!width) {
     width =
         container_size.width - *left - *right - *margin_left - *margin_right;
@@ -431,18 +431,22 @@ void ComputeAbsoluteVertical(const NGConstraintSpace& space,
 
   // Rules 4 through 6, 1 out of 3 are unknown.
   if (!top) {
-    top = container_size.height - *bottom - *height - *margin_top -
+    top = container_size.height - *height - *bottom - *margin_top -
           *margin_bottom;
   } else if (!bottom) {
     bottom =
-        container_size.height - *top - *height - *margin_top - *margin_bottom;
+        container_size.height - *height - *top - *margin_top - *margin_bottom;
   } else if (!height) {
     height =
         container_size.height - *top - *bottom - *margin_top - *margin_bottom;
   }
-  DCHECK_EQ(container_size.height,
-            *top + *bottom + *margin_top + *margin_bottom + *height);
-
+  // The DCHECK is useful, but only holds true when not saturated.
+  if (!(top->MightBeSaturated() || bottom->MightBeSaturated() ||
+        height->MightBeSaturated() || margin_top->MightBeSaturated() ||
+        margin_bottom->MightBeSaturated())) {
+    DCHECK_EQ(container_size.height,
+              *top + *bottom + *margin_top + *margin_bottom + *height);
+  }
   // If calculated height is outside of min/max constraints,
   // rerun the algorithm with constrained width.
   Optional<LayoutUnit> min_height;