Fix integer overflow in FrameView::m_visuallyNonEmptyPixelCount

third_party/WebKit/Source/core/frame/FrameView.h

 /*
    Copyright (C) 1997 Martin Jones (mjones@kde.org)
              (C) 1998 Waldo Bastian (bastian@kde.org)
              (C) 1998, 1999 Torben Weis (weis@kde.org)
              (C) 1999 Lars Knoll (knoll@kde.org)
              (C) 1999 Antti Koivisto (koivisto@kde.org)
    Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Library General Public
@@ skipping 806 matching lines @@
     Color m_baseBackgroundColor;
     IntSize m_lastViewportSize;
     float m_lastZoomFactor;
 
     AtomicString m_mediaType;
     AtomicString m_mediaTypeWhenNotPrinting;
 
     bool m_safeToPropagateScrollToParent;
 
     unsigned m_visuallyNonEmptyCharacterCount;
-    unsigned m_visuallyNonEmptyPixelCount;
+    uint64_t m_visuallyNonEmptyPixelCount;
     bool m_isVisuallyNonEmpty;
 
     Member<Node> m_fragmentAnchor;
 
     // layoutObject to hold our custom scroll corner.
     LayoutScrollbarPart* m_scrollCorner;
 
     Member<ScrollableAreaSet> m_scrollableAreas;
     Member<ScrollableAreaSet> m_animatingScrollableAreas;
     std::unique_ptr<ResizerAreaSet> m_resizerAreas;
@@ skipping 107 matching lines @@
     // The first few hundred characters rarely contain the interesting content of the page.
     static const unsigned visualCharacterThreshold = 200;
     if (m_visuallyNonEmptyCharacterCount > visualCharacterThreshold)
         setIsVisuallyNonEmpty();
 }
 
 inline void FrameView::incrementVisuallyNonEmptyPixelCount(const IntSize& size)
 {
     if (m_isVisuallyNonEmpty)
         return;
-    m_visuallyNonEmptyPixelCount += size.width() * size.height();
+    m_visuallyNonEmptyPixelCount += size.area();
     // Use a threshold value to prevent very small amounts of visible content from triggering didMeaningfulLayout.
     static const unsigned visualPixelThreshold = 32 * 32;
     if (m_visuallyNonEmptyPixelCount > visualPixelThreshold)
         setIsVisuallyNonEmpty();
 }
 
 DEFINE_TYPE_CASTS(FrameView, Widget, widget, widget->isFrameView(), widget.isFrameView());
 DEFINE_TYPE_CASTS(FrameView, ScrollableArea, scrollableArea, scrollableArea->isFrameView(), scrollableArea.isFrameView());
 
 } // namespace blink
 
 #endif // FrameView_h