Use saturated arithmetic in NinePieceImageGrid to avoid overflow

third_party/WebKit/Source/core/paint/NinePieceImageGrid.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/NinePieceImageGrid.h"
 
 #include "core/style/ComputedStyle.h"
 #include "core/style/NinePieceImage.h"
 #include "platform/LengthFunctions.h"
 #include "platform/geometry/FloatSize.h"
@@ skipping 45 matching lines @@
                                     borderWidths.bottom(), m_bottom.slice,
                                     borderImageArea.height());
   m_left.width = computeEdgeWidth(ninePieceImage.borderSlices().left(),
                                   borderWidths.left(), m_left.slice,
                                   borderImageArea.width());
 
   // The spec says: Given Lwidth as the width of the border image area, Lheight
   // as its height, and Wside as the border image width offset for the side, let
   // f = min(Lwidth/(Wleft+Wright), Lheight/(Wtop+Wbottom)). If f < 1, then all
   // W are reduced by multiplying them by f.
-  int borderSideWidth = std::max(1, m_left.width + m_right.width);
-  int borderSideHeight = std::max(1, m_top.width + m_bottom.width);
+  int borderSideWidth =
+      std::max(1, SaturatedAddition(m_left.width, m_right.width));
+  int borderSideHeight =
+      std::max(1, SaturatedAddition(m_top.width, m_bottom.width));
   float borderSideScaleFactor =
       std::min((float)borderImageArea.width() / borderSideWidth,
                (float)borderImageArea.height() / borderSideHeight);
   if (borderSideScaleFactor < 1) {
     m_top.width *= borderSideScaleFactor;
     m_right.width *= borderSideScaleFactor;
     m_bottom.width *= borderSideScaleFactor;
     m_left.width *= borderSideScaleFactor;
   }
 }
@@ skipping 222 matching lines @@
     drawInfo.source.scale(imageScaleFactor);
 
     // Compensate for source scaling by scaling down the individual tiles.
     drawInfo.tileScale.scale(1 / imageScaleFactor);
   }
 
   return drawInfo;
 }
 
 }  // namespace blink