Fix int overflow in window.moveBy

third_party/WebKit/Source/platform/geometry/IntPoint.h

Index: third_party/WebKit/Source/platform/geometry/IntPoint.h
diff --git a/third_party/WebKit/Source/platform/geometry/IntPoint.h b/third_party/WebKit/Source/platform/geometry/IntPoint.h
index 5d7825d636d37e642f8a4e9d9067fdf3a916c276..1e2f8e3547efd49f2d20f446674bdf079db9ac2c 100644
--- a/third_party/WebKit/Source/platform/geometry/IntPoint.h
+++ b/third_party/WebKit/Source/platform/geometry/IntPoint.h
@@ -31,6 +31,7 @@
 #include "wtf/Allocator.h"
 #include "wtf/Forward.h"
 #include "wtf/MathExtras.h"
+#include "wtf/SaturatedArithmetic.h"
 #include "wtf/VectorTraits.h"
 
 #if OS(MACOSX)
@@ -61,6 +62,12 @@ public:
     void move(const IntSize& s) { move(s.width(), s.height()); }
     void moveBy(const IntPoint& offset) { move(offset.x(), offset.y()); }
     void move(int dx, int dy) { m_x += dx; m_y += dy; }
+    void saturatedMove(int dx, int dy)
+    {
+        m_x = saturatedAddition(m_x, dx);
+        m_y = saturatedAddition(m_y, dy);
+    }
+
     void scale(float sx, float sy)
     {
         m_x = lroundf(static_cast<float>(m_x * sx));