Check for integer overflow in allocations.

third_party/WebKit/Source/platform/wtf/TerminatedArray.h

Index: third_party/WebKit/Source/platform/wtf/TerminatedArray.h
diff --git a/third_party/WebKit/Source/platform/wtf/TerminatedArray.h b/third_party/WebKit/Source/platform/wtf/TerminatedArray.h
index 061ccdad750ec6d31e0d53d920e235b7a18aa039..b4830b2236d564c6162f7e4244d36bda15f26869 100644
--- a/third_party/WebKit/Source/platform/wtf/TerminatedArray.h
+++ b/third_party/WebKit/Source/platform/wtf/TerminatedArray.h
@@ -98,13 +98,16 @@ class TerminatedArray {
     static PassPtr Create(size_t capacity) {
       return WTF::WrapUnique(
           static_cast<TerminatedArray*>(WTF::Partitions::FastMalloc(
-              capacity * sizeof(T), WTF_HEAP_PROFILER_TYPE_NAME(T))));
+              WTF::Partitions::ComputeAllocationSize(capacity, sizeof(T)),
+              WTF_HEAP_PROFILER_TYPE_NAME(T))));
     }
 
     static PassPtr Resize(Ptr ptr, size_t capacity) {
-      return WTF::WrapUnique(static_cast<TerminatedArray*>(
-          WTF::Partitions::FastRealloc(ptr.release(), capacity * sizeof(T),
-                                       WTF_HEAP_PROFILER_TYPE_NAME(T))));
+      return WTF::WrapUnique(
+          static_cast<TerminatedArray*>(WTF::Partitions::FastRealloc(
+              ptr.release(),
+              WTF::Partitions::ComputeAllocationSize(capacity, sizeof(T)),
+              WTF_HEAP_PROFILER_TYPE_NAME(T))));
     }
   };