| Index: Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
|
| ===================================================================
|
| --- Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp (revision 78228)
|
| +++ Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp (working copy)
|
| @@ -394,6 +394,9 @@
|
| int width = (size.width() + m_tileSize.width() - 1) / m_tileSize.width();
|
| int height = (size.height() + m_tileSize.height() - 1) / m_tileSize.height();
|
|
|
| + if (height && (width > INT_MAX / height))
|
| + CRASH();
|
| +
|
| Vector<OwnPtr<Tile> > newTiles;
|
| newTiles.resize(width * height);
|
| for (int j = 0; j < m_layerTileSize.height(); ++j)
|
|
|