Use CheckedNumeric when converting SkIRect to gfx::Rect.

ui/gfx/skia_util.cc

Index: ui/gfx/skia_util.cc
diff --git a/ui/gfx/skia_util.cc b/ui/gfx/skia_util.cc
index ca991c79ec542a7a56c2c8de334610f257cb0563..b824c106eb5cb69da44c7671d407ed0239bc6a1b 100644
--- a/ui/gfx/skia_util.cc
+++ b/ui/gfx/skia_util.cc
@@ -8,6 +8,7 @@
 #include <stdint.h>
 
 #include "base/numerics/safe_conversions.h"
+#include "base/numerics/safe_math.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "third_party/skia/include/core/SkColorFilter.h"
 #include "third_party/skia/include/core/SkColorPriv.h"
@@ -46,10 +47,27 @@ SkIRect RectToSkIRect(const Rect& rect) {
   return SkIRect::MakeXYWH(rect.x(), rect.y(), rect.width(), rect.height());
 }
 
+SkIRect RectToSkIRectChecked(const Rect& rect) {
+  return SkIRect::MakeLTRB(
+      rect.x(), rect.y(),
+      (base::CheckedNumeric<int32_t>(rect.x()) + rect.width())
+          .ValueOrDefault(std::numeric_limits<int32_t>::max()),
+      (base::CheckedNumeric<int32_t>(rect.y()) + rect.height())
+          .ValueOrDefault(std::numeric_limits<int32_t>::max()));
+}
+
 Rect SkIRectToRect(const SkIRect& rect) {
   return Rect(rect.x(), rect.y(), rect.width(), rect.height());
 }
 
+Rect SkIRectToRectChecked(const SkIRect& rect) {

[danakj, 2016/08/11 18:13:37]

OK I think I'd rather not have Checked version that we call sometimes and slowly
add that to more callsites as the fuzzer finds ways to break them.

I'm troubled that we have an SkIRect though, for whom calling width() would also
cause an overflow. Fixing that when we convert it to a gfx::Rect seems like a
systemic problem we're ignoring. Like, we should be exploding (or clamping?)
when we make that SkIRect rather than the gfx::Rect.

+  return Rect(rect.x(), rect.y(),
+              (base::CheckedNumeric<int>(rect.right()) - rect.left())
+                  .ValueOrDefault(std::numeric_limits<int>::max()),
+              (base::CheckedNumeric<int>(rect.bottom()) - rect.top())
+                  .ValueOrDefault(std::numeric_limits<int>::max()));
+}
+
 SkRect RectFToSkRect(const RectF& rect) {
   return SkRect::MakeXYWH(SkFloatToScalar(rect.x()),
                           SkFloatToScalar(rect.y()),