Fix integer overflow in FEGaussianBlur::mapRect.

third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.cpp

Index: third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.cpp
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.cpp
index 919b39ed1fa125eaf3097111f48008e3993471a9..dbdd43680b411d5592c51a9dfc96ac5a9ece82c6 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.cpp
@@ -60,8 +60,8 @@ FloatRect FEDropShadow::mapRect(const FloatRect& rect, bool forward) const
     IntSize kernelSize = FEGaussianBlur::calculateKernelSize(filter, FloatPoint(m_stdX, m_stdY));
 
     // We take the half kernel size and multiply it with three, because we run box blur three times.
-    result.inflateX(3 * kernelSize.width() * 0.5f);
-    result.inflateY(3 * kernelSize.height() * 0.5f);
+    result.inflateX(3.0f * kernelSize.width() * 0.5f);
+    result.inflateY(3.0f * kernelSize.height() * 0.5f);
     return result;
 }