Check for integer overflow in allocations.

third_party/WebKit/Source/platform/heap/HeapTerminatedArray.h

Index: third_party/WebKit/Source/platform/heap/HeapTerminatedArray.h
diff --git a/third_party/WebKit/Source/platform/heap/HeapTerminatedArray.h b/third_party/WebKit/Source/platform/heap/HeapTerminatedArray.h
index 37545ef625dfc264d2f5eb81cf40b4244162c3ad..6be8824e973447699910e282a563ba8ff243a8f0 100644
--- a/third_party/WebKit/Source/platform/heap/HeapTerminatedArray.h
+++ b/third_party/WebKit/Source/platform/heap/HeapTerminatedArray.h
@@ -8,6 +8,7 @@
 #include "platform/heap/Heap.h"
 #include "platform/wtf/TerminatedArray.h"
 #include "platform/wtf/TerminatedArrayBuilder.h"
+#include "platform/wtf/allocator/Partitions.h"
 
 namespace blink {
 
@@ -38,13 +39,15 @@ class HeapTerminatedArray : public TerminatedArray<T> {
     static PassPtr Create(size_t capacity) {
       return reinterpret_cast<HeapTerminatedArray*>(
           ThreadHeap::Allocate<HeapTerminatedArray>(
-              capacity * sizeof(T), IsEagerlyFinalizedType<T>::value));
+              WTF::Partitions::ComputeAllocationSize(capacity, sizeof(T)),
+              IsEagerlyFinalizedType<T>::value));
     }
 
     static PassPtr Resize(PassPtr ptr, size_t capacity) {
       return reinterpret_cast<HeapTerminatedArray*>(
-          ThreadHeap::Reallocate<HeapTerminatedArray>(ptr,
-                                                      capacity * sizeof(T)));
+          ThreadHeap::Reallocate<HeapTerminatedArray>(
+              ptr,
+              WTF::Partitions::ComputeAllocationSize(capacity, sizeof(T))));
     }
   };