Fix int overflow in window.moveBy

third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp

Index: third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
diff --git a/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp b/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
index 9d187897bba7726a8781d4a1bbf023314fc471e8..c3ec30627a9a655e5b2d209797afe226849fa308 100644
--- a/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
+++ b/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
@@ -1233,7 +1233,7 @@ void LocalDOMWindow::moveBy(int x, int y) const
         return;
 
     IntRect windowRect = host->chromeClient().rootWindowRect();
-    windowRect.move(x, y);
+    windowRect.saturatedMove(x, y);
     // Security check (the spec talks about UniversalBrowserWrite to disable this check...)
     host->chromeClient().setWindowRectWithAdjustment(windowRect, *frame());
 }