Prevent integer overflow in ComputedStyle::outlineOutsetExtent.

third_party/WebKit/Source/core/style/ComputedStyle.cpp

Index: third_party/WebKit/Source/core/style/ComputedStyle.cpp
diff --git a/third_party/WebKit/Source/core/style/ComputedStyle.cpp b/third_party/WebKit/Source/core/style/ComputedStyle.cpp
index 984ff42be192101a07c21c53955cd3c42a23b460..5e872511887bd9616f8627a8150dd4a5e951b1da 100644
--- a/third_party/WebKit/Source/core/style/ComputedStyle.cpp
+++ b/third_party/WebKit/Source/core/style/ComputedStyle.cpp
@@ -52,6 +52,7 @@
 #include "platform/transforms/TranslateTransformOperation.h"
 #include "wtf/MathExtras.h"
 #include "wtf/PtrUtil.h"
+#include "wtf/SaturatedArithmetic.h"
 #include <algorithm>
 #include <memory>
 
@@ -1784,7 +1785,7 @@ int ComputedStyle::outlineOutsetExtent() const
         return 0;
     if (outlineStyleIsAuto())
         return GraphicsContext::focusRingOutsetExtent(outlineOffset(), outlineWidth());
-    return std::max(0, outlineWidth() + outlineOffset());
+    return std::max(0, saturatedAddition(outlineWidth(), outlineOffset()));
 }
 
 bool ComputedStyle::columnRuleEquivalent(const ComputedStyle* otherStyle) const