Merge 80787

Source/WebCore/dom/StyleElement.cpp

Index: Source/WebCore/dom/StyleElement.cpp
===================================================================
--- Source/WebCore/dom/StyleElement.cpp	(revision 80787)
+++ Source/WebCore/dom/StyleElement.cpp	(working copy)
@@ -101,8 +101,12 @@
 
     unsigned resultLength = 0;
     for (Node* c = e->firstChild(); c; c = c->nextSibling()) {
-        if (isValidStyleChild(c))
-            resultLength += c->nodeValue().length();
+        if (isValidStyleChild(c)) {
+            unsigned length = c->nodeValue().length();
+            if (length > std::numeric_limits<unsigned>::max() - resultLength)
+                CRASH();
+            resultLength += length;
+        }
     }
     UChar* text;
     String sheetText = String::createUninitialized(resultLength, text);