Make LayoutListItem::value to use SaturatedAddition to prevent integer overflow

third_party/WebKit/Source/core/layout/LayoutListItem.cpp

Index: third_party/WebKit/Source/core/layout/LayoutListItem.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutListItem.cpp b/third_party/WebKit/Source/core/layout/LayoutListItem.cpp
index 66fb816dff564a7852117c21ec76bbde1eccc913..6c989742027127c6dc1661a27923892756f73f93 100644
--- a/third_party/WebKit/Source/core/layout/LayoutListItem.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutListItem.cpp
@@ -28,6 +28,7 @@
 #include "core/html/HTMLOListElement.h"
 #include "core/layout/LayoutListMarker.h"
 #include "core/paint/ListItemPainter.h"
+#include "wtf/SaturatedArithmetic.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/text/StringBuilder.h"
 
@@ -227,7 +228,7 @@ inline int LayoutListItem::calcValue() const {
   // FIXME: This recurses to a possible depth of the length of the list.
   // That's not good -- we need to change this to an iterative algorithm.
   if (LayoutListItem* previousItem = previousListItem(list, this))
-    return previousItem->value() + valueStep;
+    return SaturatedAddition(previousItem->value(), valueStep);
 
   if (oListElement)
     return oListElement->start();