Use CheckedNumeric when converting SkIRect to gfx::Rect.

ui/gfx/skia_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/gfx/skia_util.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include "base/numerics/safe_conversions.h"
+#include "base/numerics/safe_math.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "third_party/skia/include/core/SkColorFilter.h"
 #include "third_party/skia/include/core/SkColorPriv.h"
 #include "third_party/skia/include/core/SkUnPreMultiply.h"
 #include "third_party/skia/include/effects/SkBlurMaskFilter.h"
 #include "third_party/skia/include/effects/SkGradientShader.h"
 #include "third_party/skia/include/effects/SkLayerDrawLooper.h"
 #include "ui/gfx/geometry/quad_f.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/rect_f.h"
@@ skipping 18 matching lines @@
 SkRect RectToSkRect(const Rect& rect) {
   return SkRect::MakeXYWH(
       SkIntToScalar(rect.x()), SkIntToScalar(rect.y()),
       SkIntToScalar(rect.width()), SkIntToScalar(rect.height()));
 }
 
 SkIRect RectToSkIRect(const Rect& rect) {
   return SkIRect::MakeXYWH(rect.x(), rect.y(), rect.width(), rect.height());
 }
 
+SkIRect RectToSkIRectChecked(const Rect& rect) {
+  return SkIRect::MakeLTRB(
+      rect.x(), rect.y(),
+      (base::CheckedNumeric<int32_t>(rect.x()) + rect.width())
+          .ValueOrDefault(std::numeric_limits<int32_t>::max()),
+      (base::CheckedNumeric<int32_t>(rect.y()) + rect.height())
+          .ValueOrDefault(std::numeric_limits<int32_t>::max()));
+}
+
 Rect SkIRectToRect(const SkIRect& rect) {
   return Rect(rect.x(), rect.y(), rect.width(), rect.height());
 }
 
+Rect SkIRectToRectChecked(const SkIRect& rect) {

[danakj, 2016/08/11 18:13:37]

OK I think I'd rather not have Checked version that we call sometimes and slowly
add that to more callsites as the fuzzer finds ways to break them.

I'm troubled that we have an SkIRect though, for whom calling width() would also
cause an overflow. Fixing that when we convert it to a gfx::Rect seems like a
systemic problem we're ignoring. Like, we should be exploding (or clamping?)
when we make that SkIRect rather than the gfx::Rect.

+  return Rect(rect.x(), rect.y(),
+              (base::CheckedNumeric<int>(rect.right()) - rect.left())
+                  .ValueOrDefault(std::numeric_limits<int>::max()),
+              (base::CheckedNumeric<int>(rect.bottom()) - rect.top())
+                  .ValueOrDefault(std::numeric_limits<int>::max()));
+}
+
 SkRect RectFToSkRect(const RectF& rect) {
   return SkRect::MakeXYWH(SkFloatToScalar(rect.x()),
                           SkFloatToScalar(rect.y()),
                           SkFloatToScalar(rect.width()),
                           SkFloatToScalar(rect.height()));
 }
 
 RectF SkRectToRectF(const SkRect& rect) {
   return RectF(SkScalarToFloat(rect.x()),
                SkScalarToFloat(rect.y()),
@@ skipping 213 matching lines @@
   static const SkScalar kSkToHbRatio = SK_Scalar1 / kHbUnit1;
   return kSkToHbRatio * value;
 }
 
 float HarfBuzzUnitsToFloat(int value) {
   static const float kFloatToHbRatio = 1.0f / kHbUnit1;
   return kFloatToHbRatio * value;
 }
 
 }  // namespace gfx