Use CheckedNumeric when converting SkIRect to gfx::Rect.

ui/gfx/skia_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/gfx/skia_util.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include "base/numerics/safe_conversions.h"
+#include "base/numerics/safe_math.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "third_party/skia/include/core/SkColorFilter.h"
 #include "third_party/skia/include/core/SkColorPriv.h"
 #include "third_party/skia/include/core/SkUnPreMultiply.h"
 #include "third_party/skia/include/effects/SkBlurMaskFilter.h"
 #include "third_party/skia/include/effects/SkGradientShader.h"
 #include "third_party/skia/include/effects/SkLayerDrawLooper.h"
 #include "ui/gfx/geometry/quad_f.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/rect_f.h"
@@ skipping 18 matching lines @@
 SkRect RectToSkRect(const Rect& rect) {
   return SkRect::MakeXYWH(
       SkIntToScalar(rect.x()), SkIntToScalar(rect.y()),
       SkIntToScalar(rect.width()), SkIntToScalar(rect.height()));
 }
 
 SkIRect RectToSkIRect(const Rect& rect) {
   return SkIRect::MakeXYWH(rect.x(), rect.y(), rect.width(), rect.height());
 }
 
+// Produces a non-negative integer for the difference between min and max,
+// yielding 0 if it would be negative and INT_MAX if it would overflow.
+// This yields a length such that min+length is in range as well.
+static int ClampLengthFromRange(int min, int max) {
+  if (min > max)
+    return 0;
+  return (base::CheckedNumeric<int>(max) - min)
+      .ValueOrDefault(std::numeric_limits<int>::max());
+}
+
 Rect SkIRectToRect(const SkIRect& rect) {
-  return Rect(rect.x(), rect.y(), rect.width(), rect.height());
+  return Rect(rect.x(), rect.y(),
+              ClampLengthFromRange(rect.left(), rect.right()),
+              ClampLengthFromRange(rect.top(), rect.bottom()));
 }
 
 SkRect RectFToSkRect(const RectF& rect) {
   return SkRect::MakeXYWH(SkFloatToScalar(rect.x()),
                           SkFloatToScalar(rect.y()),
                           SkFloatToScalar(rect.width()),
                           SkFloatToScalar(rect.height()));
 }
 
 RectF SkRectToRectF(const SkRect& rect) {
@@ skipping 215 matching lines @@
   static const SkScalar kSkToHbRatio = SK_Scalar1 / kHbUnit1;
   return kSkToHbRatio * value;
 }
 
 float HarfBuzzUnitsToFloat(int value) {
   static const float kFloatToHbRatio = 1.0f / kHbUnit1;
   return kFloatToHbRatio * value;
 }
 
 }  // namespace gfx