Fix regression in CJBig2_TRDProc.

Commit 7695dd0f mistakenly changed a signed integer to unsigned. This is
incorrect because right shifts for negative integers behave differently.

BUG=chromium:859284

Change-Id: Id9c54848b15ace1de080c174f261dd2c064018e0
Reviewed-on: https://pdfium-review.googlesource.com/37230
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/core/fxcodec/jbig2/JBig2_TrdProc.cpp b/core/fxcodec/jbig2/JBig2_TrdProc.cpp
index 4790f66..79b2142 100644
--- a/core/fxcodec/jbig2/JBig2_TrdProc.cpp
+++ b/core/fxcodec/jbig2/JBig2_TrdProc.cpp
@@ -27,11 +27,11 @@
   return {result.ValueOrDie()};
 }
 
-Optional<int32_t> CheckTRDReferenceDimension(uint32_t dimension,
-                                             uint32_t divisor,
+Optional<int32_t> CheckTRDReferenceDimension(int32_t dimension,
+                                             uint32_t shift,
                                              int32_t offset) {
   FX_SAFE_INT32 result = offset;
-  result += dimension / divisor;
+  result += dimension >> shift;
   if (!result.IsValid())
     return {};
   return {result.ValueOrDie()};
@@ -162,9 +162,9 @@
           return nullptr;
 
         Optional<int32_t> GRREFERENCEDX =
-            CheckTRDReferenceDimension(RDWI, 4, RDXI);
+            CheckTRDReferenceDimension(RDWI, 2, RDXI);
         Optional<int32_t> GRREFERENCEDY =
-            CheckTRDReferenceDimension(RDHI, 4, RDYI);
+            CheckTRDReferenceDimension(RDHI, 2, RDYI);
         if (!GRREFERENCEDX || !GRREFERENCEDY)
           return nullptr;
 
@@ -342,9 +342,9 @@
           return nullptr;
 
         Optional<int32_t> GRREFERENCEDX =
-            CheckTRDReferenceDimension(RDWI, 2, RDXI);
+            CheckTRDReferenceDimension(RDWI, 1, RDXI);
         Optional<int32_t> GRREFERENCEDY =
-            CheckTRDReferenceDimension(RDHI, 2, RDYI);
+            CheckTRDReferenceDimension(RDHI, 1, RDYI);
         if (!GRREFERENCEDX || !GRREFERENCEDY)
           return nullptr;