cc: Use CheckedNumeric for resource size calculations.

cc/resources/resource.h

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CC_RESOURCES_RESOURCE_H_
 #define CC_RESOURCES_RESOURCE_H_
 
+#include "base/numerics/safe_math.h"
 #include "cc/base/cc_export.h"
 #include "cc/resources/resource_provider.h"
 #include "ui/gfx/geometry/size.h"
 
 namespace cc {
 
 class CC_EXPORT Resource {
  public:
   Resource() : id_(0) {}
   Resource(unsigned id, const gfx::Size& size, ResourceFormat format)
       : id_(id),
         size_(size),
         format_(format) {}
 
   ResourceId id() const { return id_; }
   gfx::Size size() const { return size_; }
   ResourceFormat format() const { return format_; }
-  size_t bytes() const;
 
-  inline static size_t MemorySizeBytes(const gfx::Size& size,
+  // Return true if the call to UncheckedMemorySizeBytes would return a value
+  // that fits in a size_t.
+  static bool VerifySizeInBytes(const gfx::Size& size,
+                                ResourceFormat format,
+                                size_t* bytes) {
+    if (size.IsEmpty()) {
+      if (bytes)
+        *bytes = 0;
+      return true;
+    }
+
+    base::CheckedNumeric<size_t> checked_value = BitsPerPixel(format);
+    checked_value *= size.width();
+    checked_value *= size.height();
+    if (!checked_value.IsValid())
+      return false;
+    size_t value = checked_value.ValueOrDie();
+    if ((value % 8) != 0)
+      return false;
+    if (bytes)
+      *bytes = value / 8;

[danakj, 2015/06/04 22:43:49]

Eh, you're adding this optional pointer thing just to avoid duplicating like 3
lines of code over to CheckedMemorySizeBytes?

If it's the %8 stuff you're worried about, DCHECK(VerifySizeInBytes) there too?
CheckedMemorySizeBytes should just be DCHECK(..whatever you want..) and then
computing CheckedNumeric and return ValueOrDie. Else this is so many branches
just to compute a number.

[vmpstr, 2015/06/04 23:17:30]

Done.

+    return true;
+  }
+
+  static size_t CheckedMemorySizeBytes(const gfx::Size& size,
                                        ResourceFormat format) {
-    DCHECK_EQ(0, (BitsPerPixel(format) * size.width() * size.height()) % 8);
-    // TODO(vmpstr): Make this function overflow safe. crbug.com/495867
-    return static_cast<size_t>(
-        (BitsPerPixel(format) * size.width() * size.height()) / 8);
+    size_t bytes = 0;
+    bool is_valid = VerifySizeInBytes(size, format, &bytes);
+    CHECK(is_valid);
+    return bytes;
+  }
+
+  inline static size_t UncheckedMemorySizeBytes(const gfx::Size& size,
+                                                ResourceFormat format) {
+    if (size.IsEmpty())
+      return 0;
+    DCHECK(VerifySizeInBytes(size, format, nullptr));
+    return static_cast<size_t>(BitsPerPixel(format)) * size.width() *
+           size.height() / 8;
   }
 
  protected:
   void set_id(ResourceId id) { id_ = id; }
   void set_dimensions(const gfx::Size& size, ResourceFormat format) {
     size_ = size;
     format_ = format;
   }
 
  private:
   ResourceId id_;
   gfx::Size size_;
   ResourceFormat format_;
 
   DISALLOW_COPY_AND_ASSIGN(Resource);
 };
 
 }  // namespace cc
 
 #endif  // CC_RESOURCES_RESOURCE_H_