Merge 69735

WebCore/rendering/RootInlineBox.cpp

Index: WebCore/rendering/RootInlineBox.cpp
===================================================================
--- WebCore/rendering/RootInlineBox.cpp	(revision 70336)
+++ WebCore/rendering/RootInlineBox.cpp	(working copy)
@@ -229,9 +229,13 @@
     placeBoxesVertically(heightOfBlock, maxHeight, maxAscent, noQuirksMode, lineTop, lineBottom);
     computeVerticalOverflow(lineTop, lineBottom, noQuirksMode, textBoxDataMap);
     setLineTopBottomPositions(lineTop, lineBottom);
+
+    // Detect integer overflow.
+    if (heightOfBlock > numeric_limits<int>::max() - maxHeight)
+        return numeric_limits<int>::max();
+
+    heightOfBlock = heightOfBlock + maxHeight;
     
-    heightOfBlock += maxHeight;
-    
     return heightOfBlock;
 }