Fix integer overflow in FEGaussianBlur::mapRect.

third_party/WebKit/Source/platform/graphics/filters/FilterOperation.cpp

Index: third_party/WebKit/Source/platform/graphics/filters/FilterOperation.cpp
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FilterOperation.cpp b/third_party/WebKit/Source/platform/graphics/filters/FilterOperation.cpp
index 46165337c1ebea32cb942e1670411609335afc57..b7c9ec929c1d4f4e362ab4a7846d2679e60ad7f3 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FilterOperation.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FilterOperation.cpp
@@ -38,8 +38,8 @@ static inline FloatSize outsetSizeForBlur(float stdDeviation)
     IntSize kernelSize = FEGaussianBlur::calculateUnscaledKernelSize(FloatPoint(stdDeviation, stdDeviation));
     FloatSize outset;
     // We take the half kernel size and multiply it with three, because we run box blur three times.
-    outset.setWidth(3 * kernelSize.width() * 0.5f);
-    outset.setHeight(3 * kernelSize.height() * 0.5f);
+    outset.setWidth(3.0f * kernelSize.width() * 0.5f);
+    outset.setHeight(3.0f * kernelSize.height() * 0.5f);
     return outset;
 }