Merge 69735

WebCore/rendering/RootInlineBox.cpp

 /*
  * Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 211 matching lines @@
 
     if (maxAscent + maxDescent < max(maxPositionTop, maxPositionBottom))
         adjustMaxAscentAndDescent(maxAscent, maxDescent, maxPositionTop, maxPositionBottom);
 
     int maxHeight = maxAscent + maxDescent;
     int lineTop = heightOfBlock;
     int lineBottom = heightOfBlock;
     placeBoxesVertically(heightOfBlock, maxHeight, maxAscent, noQuirksMode, lineTop, lineBottom);
     computeVerticalOverflow(lineTop, lineBottom, noQuirksMode, textBoxDataMap);
     setLineTopBottomPositions(lineTop, lineBottom);
-    
-    heightOfBlock += maxHeight;
+
+    // Detect integer overflow.
+    if (heightOfBlock > numeric_limits<int>::max() - maxHeight)
+        return numeric_limits<int>::max();
+
+    heightOfBlock = heightOfBlock + maxHeight;
     
     return heightOfBlock;
 }
 
 GapRects RootInlineBox::fillLineSelectionGap(int selTop, int selHeight, RenderBlock* rootBlock, int blockX, int blockY, int tx, int ty,
                                              const PaintInfo* paintInfo)
 {
     RenderObject::SelectionState lineState = selectionState();
 
     bool leftGap, rightGap;
@@ skipping 182 matching lines @@
 {
     block()->lineBoxes()->extractLineBox(this);
 }
 
 void RootInlineBox::attachLineBoxToRenderObject()
 {
     block()->lineBoxes()->attachLineBox(this);
 }
 
 } // namespace WebCore