Use saturated arithmetic in NinePieceImageGrid to avoid overflow

third_party/WebKit/Source/core/paint/NinePieceImageGrid.cpp

Index: third_party/WebKit/Source/core/paint/NinePieceImageGrid.cpp
diff --git a/third_party/WebKit/Source/core/paint/NinePieceImageGrid.cpp b/third_party/WebKit/Source/core/paint/NinePieceImageGrid.cpp
index 087128fc5512398504e76608a9ce74fdfcf0309c..f918106fe88ec25ac0f3c16dda54930be4af1119 100644
--- a/third_party/WebKit/Source/core/paint/NinePieceImageGrid.cpp
+++ b/third_party/WebKit/Source/core/paint/NinePieceImageGrid.cpp
@@ -63,8 +63,10 @@ NinePieceImageGrid::NinePieceImageGrid(const NinePieceImage& ninePieceImage,
   // as its height, and Wside as the border image width offset for the side, let
   // f = min(Lwidth/(Wleft+Wright), Lheight/(Wtop+Wbottom)). If f < 1, then all
   // W are reduced by multiplying them by f.
-  int borderSideWidth = std::max(1, m_left.width + m_right.width);
-  int borderSideHeight = std::max(1, m_top.width + m_bottom.width);
+  int borderSideWidth =
+      std::max(1, SaturatedAddition(m_left.width, m_right.width));
+  int borderSideHeight =
+      std::max(1, SaturatedAddition(m_top.width, m_bottom.width));
   float borderSideScaleFactor =
       std::min((float)borderImageArea.width() / borderSideWidth,
                (float)borderImageArea.height() / borderSideHeight);