Merge 78143

Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 376 matching lines @@
 }
 
 void LayerTilerChromium::resizeLayer(const IntSize& size)
 {
     if (m_layerSize == size)
         return;
 
     int width = (size.width() + m_tileSize.width() - 1) / m_tileSize.width();
     int height = (size.height() + m_tileSize.height() - 1) / m_tileSize.height();
 
+    if (height && (width > INT_MAX / height))
+        CRASH();
+
     Vector<OwnPtr<Tile> > newTiles;
     newTiles.resize(width * height);
     for (int j = 0; j < m_layerTileSize.height(); ++j)
         for (int i = 0; i < m_layerTileSize.width(); ++i)
             newTiles[i + j * width].swap(m_tiles[i + j * m_layerTileSize.width()]);
 
     m_tiles.swap(newTiles);
     m_layerSize = size;
     m_layerTileSize = IntSize(width, height);
 }
 
 void LayerTilerChromium::growLayerToContain(const IntRect& contentRect)
 {
     // Grow the tile array to contain this content rect.
     IntRect layerRect = contentRectToLayerRect(contentRect);
     IntSize layerSize = IntSize(layerRect.right(), layerRect.bottom());
 
     IntSize newSize = layerSize.expandedTo(m_layerSize);
     resizeLayer(newSize);
 }
 
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)