Overflow-proof the computation of stack region end.

third_party/WebKit/Source/platform/heap/StackFrameDepth.cpp

Index: third_party/WebKit/Source/platform/heap/StackFrameDepth.cpp
diff --git a/third_party/WebKit/Source/platform/heap/StackFrameDepth.cpp b/third_party/WebKit/Source/platform/heap/StackFrameDepth.cpp
index 345e71b1970e485f3dfb6fe7570097dc823e98ca..e53e6a3cf48c13ea8f035b3e8c474bdc490866ed 100644
--- a/third_party/WebKit/Source/platform/heap/StackFrameDepth.cpp
+++ b/third_party/WebKit/Source/platform/heap/StackFrameDepth.cpp
@@ -42,8 +42,11 @@ void StackFrameDepth::enableStackLimit()
 
     size_t stackSize = getUnderestimatedStackSize();
     if (stackSize) {
-        size_t stackBase = reinterpret_cast<size_t>(getStackStart());
-        s_stackFrameLimit = stackBase - stackSize + kStackRoomSize;
+        Address stackBase = reinterpret_cast<Address>(getStackStart());
+        RELEASE_ASSERT(stackSize > static_cast<const size_t>(kStackRoomSize));
+        size_t stackRoom = stackSize - kStackRoomSize;
+        RELEASE_ASSERT(stackBase > reinterpret_cast<Address>(stackRoom));
+        s_stackFrameLimit = reinterpret_cast<uintptr_t>(stackBase - stackRoom);
         return;
     }