Avoid integer overflow in WheelEvent constructor

Bug: 910582
Change-Id: I257e60f95b2c8b7509120991544dc70d6bcfe015
Reviewed-on: https://chromium-review.googlesource.com/c/1452794Reviewed-by: David Bokan <bokan@chromium.org>
Commit-Queue: Navid Zolghadr <nzolghadr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#629174}

third_party/blink/renderer/core/events/wheel_event.cc

@@ -83,10 +83,12 @@ WheelEvent::WheelEvent()
 WheelEvent::WheelEvent(const AtomicString& type,
                        const WheelEventInit* initializer)
     : MouseEvent(type, initializer),
-      wheel_delta_(initializer->wheelDeltaX() ? initializer->wheelDeltaX()
-                                              : -initializer->deltaX(),
-                   initializer->wheelDeltaY() ? initializer->wheelDeltaY()
-                                              : -initializer->deltaY()),
+      wheel_delta_(initializer->wheelDeltaX()
+                       ? initializer->wheelDeltaX()
+                       : NegateIfPossible(-initializer->deltaX()),
+                   initializer->wheelDeltaY()
+                       ? initializer->wheelDeltaY()
+                       : NegateIfPossible(-initializer->deltaY())),
       delta_x_(initializer->deltaX()
                    ? initializer->deltaX()
                    : NegateIfPossible(initializer->wheelDeltaX())),