Clamp overflow OL counter values

Bug: 1161232
Change-Id: I022b51133370062c9419198f44e2a5723256825e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2613364Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#840769}

third_party/blink/renderer/core/layout/layout_counter.cc

@@ -24,6 +24,7 @@
 #include <memory>
 
 #include "base/memory/ptr_util.h"
+#include "base/numerics/clamped_math.h"
 #include "third_party/blink/renderer/core/css/counter_style.h"
 #include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/dom/element_traversal.h"
@@ -204,8 +205,8 @@ bool PlanCounter(LayoutObject& object,
         return true;
       }
       if (auto* olist = DynamicTo<HTMLOListElement>(*e)) {
-        value =
-            olist->StartConsideringItemCount() + (olist->IsReversed() ? 1 : -1);
+        value = base::ClampAdd(olist->StartConsideringItemCount(),
+                               olist->IsReversed() ? 1 : -1);
         type_mask = CounterNode::kResetType;
         return true;
       }