Merge 98374

Source/WebCore/css/CSSParser.cpp

Index: Source/WebCore/css/CSSParser.cpp
===================================================================
--- Source/WebCore/css/CSSParser.cpp	(revision 99073)
+++ Source/WebCore/css/CSSParser.cpp	(working copy)
@@ -615,9 +615,9 @@
 {
     OwnPtr<CSSProperty> prop(adoptPtr(new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand)));
     if (m_numParsedProperties >= m_maxParsedProperties) {
+        if (m_numParsedProperties > (UINT_MAX / sizeof(CSSProperty*)) - 32)
+            CRASH();  // Avoid inconsistencies with rollbackLastProperties.
         m_maxParsedProperties += 32;
-        if (m_maxParsedProperties > UINT_MAX / sizeof(CSSProperty*))
-            return;
         m_parsedProperties = static_cast<CSSProperty**>(fastRealloc(m_parsedProperties,
             m_maxParsedProperties * sizeof(CSSProperty*)));
     }