| Index: chrome/browser/renderer_host/backing_store_x.cc
|
| diff --git a/chrome/browser/renderer_host/backing_store_x.cc b/chrome/browser/renderer_host/backing_store_x.cc
|
| index b7f5408a7e63f881b81e6c171492b24e6a9cf4fc..5a11ba0a12dde9966b9c6a911ff5836134fcfa46 100644
|
| --- a/chrome/browser/renderer_host/backing_store_x.cc
|
| +++ b/chrome/browser/renderer_host/backing_store_x.cc
|
| @@ -326,8 +326,8 @@ bool BackingStoreX::CopyFromBackingStore(const gfx::Rect& rect,
|
| }
|
| // Create the shared memory segment for the image and map it.
|
| if (image->bytes_per_line == 0 || image->height == 0 ||
|
| - (std::numeric_limits<size_t>::max() / image->bytes_per_line) >
|
| - static_cast<size_t>(image->height)) {
|
| + static_cast<size_t>(image->height) >
|
| + (std::numeric_limits<size_t>::max() / image->bytes_per_line)) {
|
| XDestroyImage(image);
|
| return false;
|
| }
|
|
|