Fix integer overflow in ComputedStyle::computedLineHeight

Source/core/layout/style/LayoutStyle.cpp

 /*
  * Copyright (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 1236 matching lines @@
 
 int LayoutStyle::computedLineHeight() const
 {
     const Length& lh = lineHeight();
 
     // Negative value means the line height is not set. Use the font's built-in spacing.
     if (lh.isNegative())
         return fontMetrics().lineSpacing();
 
     if (lh.isPercent())
-        return minimumValueForLength(lh, fontSize());
+        return LayoutUnit::clamp(minimumValueForLength(lh, fontSize()));

[pdr., 2015/03/18 03:49:42]

This fix seems too deep if it's only for shapes. Do we only hit this with shape
code? I wonder if this should be closer to the "The shape-outside image is too
large" warning?

 
-    return lh.value();
+    return std::min(static_cast<double>(std::numeric_limits<int>::max()), static_cast<double>(lh.value()));
 }
 
 void LayoutStyle::setWordSpacing(float wordSpacing)
 {
     FontSelector* currentFontSelector = font().fontSelector();
     FontDescription desc(fontDescription());
     desc.setWordSpacing(wordSpacing);
     setFontDescription(desc);
     font().update(currentFontSelector);
 }
@@ skipping 452 matching lines @@
         horizontal || includeLogicalRightEdge);
 
     edges[BSLeft] = BorderEdge(borderLeftWidth(),
         visitedDependentColor(CSSPropertyBorderLeftColor),
         borderLeftStyle(),
         borderLeftIsTransparent(),
         !horizontal || includeLogicalLeftEdge);
 }
 
 } // namespace blink