| Index: Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
 | 
| ===================================================================
 | 
| --- Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp	(revision 78228)
 | 
| +++ Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp	(working copy)
 | 
| @@ -394,6 +394,9 @@
 | 
|      int width = (size.width() + m_tileSize.width() - 1) / m_tileSize.width();
 | 
|      int height = (size.height() + m_tileSize.height() - 1) / m_tileSize.height();
 | 
|  
 | 
| +    if (height && (width > INT_MAX / height))
 | 
| +        CRASH();
 | 
| +
 | 
|      Vector<OwnPtr<Tile> > newTiles;
 | 
|      newTiles.resize(width * height);
 | 
|      for (int j = 0; j < m_layerTileSize.height(); ++j)
 | 
| 
 |