| Index: content/browser/renderer_host/software_frame_manager.cc
|
| diff --git a/content/browser/renderer_host/software_frame_manager.cc b/content/browser/renderer_host/software_frame_manager.cc
|
| index 3630e59c05f8974126a4f6bbe51b4be6c88ca718..d4fc273fb7db84b9507abee2fddafc1e222c05bf 100644
|
| --- a/content/browser/renderer_host/software_frame_manager.cc
|
| +++ b/content/browser/renderer_host/software_frame_manager.cc
|
| @@ -8,6 +8,7 @@
|
| #include "base/callback_helpers.h"
|
| #include "base/debug/alias.h"
|
| #include "base/numerics/safe_math.h"
|
| +#include "cc/resources/shared_bitmap.h"
|
| #include "content/browser/renderer_host/dip_util.h"
|
| #include "content/public/browser/user_metrics.h"
|
|
|
| @@ -97,9 +98,11 @@ bool SoftwareFrameManager::SwapToNewFrame(
|
|
|
| // The NULL handle is used in testing.
|
| if (base::SharedMemory::IsHandleValid(shared_memory->handle())) {
|
| - DCHECK(frame_data->CheckedSizeInBytes().IsValid())
|
| - << "Integer overflow when computing bytes to map.";
|
| - size_t size_in_bytes = frame_data->SizeInBytes();
|
| + DCHECK(cc::SharedBitmap::VerifySizeInBytes(frame_data->size));
|
| + // UncheckedSizeInBytes is okay because the frame_data size was verified
|
| + // when frame_data was received over IPC.
|
| + size_t size_in_bytes =
|
| + cc::SharedBitmap::UncheckedSizeInBytes(frame_data->size);
|
| #ifdef OS_WIN
|
| if (!shared_memory->Map(0)) {
|
| DLOG(ERROR) << "Unable to map renderer memory.";
|
|
|