[CSS Grid Layout] OOB access in RenderGrid with a grid item with negative position index
https://bugs.webkit.org/show_bug.cgi?id=112853

Reviewed by Tony Chang.

Source/WebCore:

This issue was caused by us casting a negative int to a size_t by mistake. This
would make us not size the grid properly thus yielding to OOB access during the
rest of the layout.

Test: fast/css-grid-layout/grid-item-negative-indexes.html

* rendering/RenderGrid.cpp:
(WebCore::estimatedGridSizeForPosition):
Added this helper function to do the proper estimation and checks that our
position can be represented by a size_t.

(WebCore::RenderGrid::maximumIndexInDirection):
Updated to use estimatedGridSizeForPosition.

LayoutTests:

* fast/css-grid-layout/grid-item-negative-indexes-expected.txt: Added.
* fast/css-grid-layout/grid-item-negative-indexes.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146470 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed GTK gardening.

Marking http/tests/appcache/abort-cache-ondownloading-resource-404.html as flaky.
Unskipping tests under perf/ to see how they behave.

* platform/gtk/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146471 268f45cc-cd09-0410-ab3c-d52691b4dbfc