Make LayoutListItem::value to use SaturatedAddition to prevent integer overflow

third_party/WebKit/Source/core/layout/LayoutListItem.cpp

 /**
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 10 matching lines @@
  *
  */
 
 #include "core/layout/LayoutListItem.h"
 
 #include "core/HTMLNames.h"
 #include "core/dom/shadow/FlatTreeTraversal.h"
 #include "core/html/HTMLOListElement.h"
 #include "core/layout/LayoutListMarker.h"
 #include "core/paint/ListItemPainter.h"
+#include "wtf/SaturatedArithmetic.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/text/StringBuilder.h"
 
 namespace blink {
 
 using namespace HTMLNames;
 
 LayoutListItem::LayoutListItem(Element* element)
     : LayoutBlockFlow(element),
       m_marker(nullptr),
@@ skipping 179 matching lines @@
   Node* list = enclosingList(this);
   HTMLOListElement* oListElement =
       isHTMLOListElement(list) ? toHTMLOListElement(list) : nullptr;
   int valueStep = 1;
   if (oListElement && oListElement->isReversed())
     valueStep = -1;
 
   // FIXME: This recurses to a possible depth of the length of the list.
   // That's not good -- we need to change this to an iterative algorithm.
   if (LayoutListItem* previousItem = previousListItem(list, this))
-    return previousItem->value() + valueStep;
+    return SaturatedAddition(previousItem->value(), valueStep);
 
   if (oListElement)
     return oListElement->start();
 
   return 1;
 }
 
 void LayoutListItem::updateValueNow() const {
   m_value = calcValue();
   m_isValueUpToDate = true;
@@ skipping 299 matching lines @@
       // assume that all the following ones have too.
       // This gives us the opportunity to stop here and avoid
       // marking the same nodes again.
       break;
     }
     item->updateValue();
   }
 }
 
 }  // namespace blink