Use CheckedNumeric when converting SkIRect to gfx::Rect.

ui/gfx/skia_util.cc

Index: ui/gfx/skia_util.cc
diff --git a/ui/gfx/skia_util.cc b/ui/gfx/skia_util.cc
index ca991c79ec542a7a56c2c8de334610f257cb0563..09dd4a794a533e5479853cd4d320ca38a7f0a055 100644
--- a/ui/gfx/skia_util.cc
+++ b/ui/gfx/skia_util.cc
@@ -8,6 +8,7 @@
 #include <stdint.h>
 
 #include "base/numerics/safe_conversions.h"
+#include "base/numerics/safe_math.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "third_party/skia/include/core/SkColorFilter.h"
 #include "third_party/skia/include/core/SkColorPriv.h"
@@ -47,7 +48,11 @@ SkIRect RectToSkIRect(const Rect& rect) {
 }
 
 Rect SkIRectToRect(const SkIRect& rect) {
-  return Rect(rect.x(), rect.y(), rect.width(), rect.height());
+  return Rect(rect.x(), rect.y(),
+              (base::CheckedNumeric<int>(rect.right()) - rect.left())

[danakj, 2016/08/22 20:01:49]

I see, ok so checking right-left here makes sense then.

+                  .ValueOrDefault(std::numeric_limits<int>::max()),

[danakj, 2016/08/22 20:01:49]

But if x >= 0, the right() will still overflow with a width of max() so we need
some clamping in gfx::Rect too?

[jbroman, 2016/08/23 03:26:58]

That cannot happen here, since SkIRect::fRight must have been in the range of
int32_t, and we do not support any platforms where sizeof(int) <
sizeof(int32_t).

The only exception I can think of is the case of a rectangle with negative
width/height in Skia, which could underflow. I'll handle that case and add unit
tests to clarify.

+              (base::CheckedNumeric<int>(rect.bottom()) - rect.top())
+                  .ValueOrDefault(std::numeric_limits<int>::max()));
 }
 
 SkRect RectFToSkRect(const RectF& rect) {