Fix integer overflow in FrameView::m_visuallyNonEmptyPixelCount

third_party/WebKit/Source/core/frame/FrameView.h

Index: third_party/WebKit/Source/core/frame/FrameView.h
diff --git a/third_party/WebKit/Source/core/frame/FrameView.h b/third_party/WebKit/Source/core/frame/FrameView.h
index 9511bd39e10e280e7e0e5e4b9bac01db23b710ed..4992584062196c7337d05a3801e250a24b8e1d87 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.h
+++ b/third_party/WebKit/Source/core/frame/FrameView.h
@@ -824,7 +824,7 @@ private:
     bool m_safeToPropagateScrollToParent;
 
     unsigned m_visuallyNonEmptyCharacterCount;
-    unsigned m_visuallyNonEmptyPixelCount;
+    uint64_t m_visuallyNonEmptyPixelCount;
     bool m_isVisuallyNonEmpty;
 
     Member<Node> m_fragmentAnchor;
@@ -952,7 +952,7 @@ inline void FrameView::incrementVisuallyNonEmptyPixelCount(const IntSize& size)
 {
     if (m_isVisuallyNonEmpty)
         return;
-    m_visuallyNonEmptyPixelCount += size.width() * size.height();
+    m_visuallyNonEmptyPixelCount += size.area();
     // Use a threshold value to prevent very small amounts of visible content from triggering didMeaningfulLayout.
     static const unsigned visualPixelThreshold = 32 * 32;
     if (m_visuallyNonEmptyPixelCount > visualPixelThreshold)