Intrinsic block-size should be >= border+scrollbar+padding.
In some special-code for text areas, subtract before adding, to avoid
issues with saturated arithmetic in LayoutUnit. If
current_intrinsic_block_size is LayoutUnit::Max(), and
default_intrinsic_size + border_scrollbar_padding.BlockSum() is
LayoutUnit::Max(), and ComputeScrollbars(space, node).BlockSum() is
greater than zero, we'd end up with returning an intrinsic block-size
less than border_scrollbar_padding.BlockSum(), which is wrong and would
hit a DCHECK further down in the sizing machinery.
This might fix crbug.com/1289408 (but I didn't test - need to follow
some special steps in order to do that).
Bug: 1289408
Change-Id: I6d3d8c96828998553adb6e451e905a1aeb8f7b04
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3486499
Reviewed-by: Kent Tamura <tkent@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/main@{#974963}
diff --git a/css/css-sizing/textarea-large-padding-crash.html b/css/css-sizing/textarea-large-padding-crash.html
new file mode 100644
index 0000000..b156c55
--- /dev/null
+++ b/css/css-sizing/textarea-large-padding-crash.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1289408">
+<textarea style="padding:12345967890px;"></textarea>
