Fix integer overflow in ObjectPainter and divide by zero in Color.

Fix integer overflow in ObjectPainter and divide by zero in Color.

BUG=652589
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Committed: https://crrev.com/c38aced892d8066f08f3babe797d0daca9f66611
Cr-Commit-Position: refs/heads/master@{#424041}

[wkorman, 2016-10-07 22:09:24]

Description was changed from

==========
Fix integer overflow and divide by zero.

BUG=652589
==========

to

==========
Fix integer overflow and divide by zero.

BUG=652589
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

[wkorman, 2016-10-07 22:12:31]

wkorman@chromium.org changed reviewers:
+ eae@chromium.org, pdr@chromium.org

[wkorman, 2016-10-07 22:12:31]

For discussion -- there are more addition/subtraction ops in ObjectPainter we
should technically guard. Before I potentially do that, I wanted to make sure
there isn't an alternate preferred approach. For example:

- we could switch these values to LayoutUnit which I think will prevent
over/underflow due to use of saturated arithmetic
- perhaps there's something I should be using rather than writing my own
safeAdd/safeSubtract in wtf/MathExtras.h but I didn't immediately see it
- perhaps we should be clamping the input values somewhere earlier in the call
stack.

The bug and fuzz test case only show the issue in ObjectPainter, but while
testing with ubsan locally I also found the divide-by-zero in Color.

[pdr., 2016-10-07 22:14:35]

https://codereview.chromium.org/2404583002/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/paint/ObjectPainter.cpp (right):

https://codereview.chromium.org/2404583002/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/paint/ObjectPainter.cpp:218: int safeSubtract(int
a, int b) {
I think you can use the existing code in SaturatedArithmetic.h

[wkorman, 2016-10-07 23:43:19]

Applied to all operations. We could be surgical to just the areas reported by
fuzz, but seems we may as well be thorough?

https://codereview.chromium.org/2404583002/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/paint/ObjectPainter.cpp (right):

https://codereview.chromium.org/2404583002/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/paint/ObjectPainter.cpp:218: int safeSubtract(int
a, int b) {
On 2016/10/07 22:14:35, pdr. wrote:
> I think you can use the existing code in SaturatedArithmetic.h

Done.

[wkorman, 2016-10-07 23:43:35]

Description was changed from

==========
Fix integer overflow and divide by zero.

BUG=652589
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

to

==========
Fix integer overflow in ObjectPainter and divide by zero in Color.

BUG=652589
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

[eae, 2016-10-07 23:46:04]

OK, LGTM

[pdr., 2016-10-08 00:02:13]

Kinda ugly but safe. LGTM

[wkorman, 2016-10-08 00:13:05]

The CQ bit was checked by wkorman@chromium.org

[wkorman, 2016-10-08 00:13:05]

The patchset sent to the CQ was uploaded after l-g-t-m from pdr@chromium.org,
eae@chromium.org
Link to the patchset: https://codereview.chromium.org/2404583002/#ps40001
(title: "Fix two typos converting to saturated.")

[commit-bot: I haz the power, 2016-10-08 00:13:32]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-08 01:59:34]

Description was changed from

==========
Fix integer overflow in ObjectPainter and divide by zero in Color.

BUG=652589
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

to

==========
Fix integer overflow in ObjectPainter and divide by zero in Color.

BUG=652589
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

[commit-bot: I haz the power, 2016-10-08 01:59:36]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-10-08 02:01:59]

Description was changed from

==========
Fix integer overflow in ObjectPainter and divide by zero in Color.

BUG=652589
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
==========

to

==========
Fix integer overflow in ObjectPainter and divide by zero in Color.

BUG=652589
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Committed: https://crrev.com/c38aced892d8066f08f3babe797d0daca9f66611
Cr-Commit-Position: refs/heads/master@{#424041}
==========

[commit-bot: I haz the power, 2016-10-08 02:02:01]

Patchset 3 (id:??) landed as
https://crrev.com/c38aced892d8066f08f3babe797d0daca9f66611
Cr-Commit-Position: refs/heads/master@{#424041}