cc: Prevent float-cast-overflow in MapRectInternal.

cc/output/filter_operations_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 
 #include "cc/output/filter_operations.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/skia/include/effects/SkBlurImageFilter.h"
 #include "third_party/skia/include/effects/SkDropShadowImageFilter.h"
@@ skipping 21 matching lines @@
   FilterOperations ops;
   ops.Append(FilterOperation::CreateBlurFilter(20));
   EXPECT_EQ(gfx::Rect(-60, -60, 130, 130),
             ops.MapRect(gfx::Rect(0, 0, 10, 10), SkMatrix::I()));
   EXPECT_EQ(gfx::Rect(-120, -120, 260, 260),
             ops.MapRect(gfx::Rect(0, 0, 20, 20), SkMatrix::MakeScale(2, 2)));
   EXPECT_EQ(gfx::Rect(-60, -70, 130, 130),
             ops.MapRect(gfx::Rect(0, -10, 10, 10), SkMatrix::MakeScale(1, -1)));
 }
 
+TEST(FilterOperationsTest, MapRectBlurOverflow) {
+  // Passes if float-cast-overflow does not occur in ubsan builds.
+  // The blur spread exceeds INT_MAX.
+  FilterOperations ops;
+  ops.Append(FilterOperation::CreateBlurFilter(2e9f));
+  ops.MapRect(gfx::Rect(0, 0, 10, 10), SkMatrix::I());
+}
+
 TEST(FilterOperationsTest, MapRectReverseBlur) {
   FilterOperations ops;
   ops.Append(FilterOperation::CreateBlurFilter(20));
   EXPECT_EQ(gfx::Rect(-60, -60, 130, 130),
             ops.MapRectReverse(gfx::Rect(0, 0, 10, 10), SkMatrix::I()));
   EXPECT_EQ(
       gfx::Rect(-120, -120, 260, 260),
       ops.MapRectReverse(gfx::Rect(0, 0, 20, 20), SkMatrix::MakeScale(2, 2)));
   EXPECT_EQ(gfx::Rect(-60, -70, 130, 130),
             ops.MapRectReverse(gfx::Rect(0, -10, 10, 10),
@@ skipping 910 matching lines @@
 
   filters.Append(FilterOperation::CreateSaturateFilter(3.f));
   filters.Append(FilterOperation::CreateBlurFilter(2.f));
   EXPECT_EQ(std::string("{\"FilterOperations\":[{\"amount\":3.0,\"type\":2},"
                         "{\"amount\":2.0,\"type\":8}]}"),
             filters.ToString());
 }
 
 }  // namespace
 }  // namespace cc