Update GPU memory buffers to use StrideInBytes internally.

content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.cc

Index: content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.cc
diff --git a/content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.cc b/content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.cc
index 5572c1fa2a92ab8422d61ebe7d65efef2b0818ae..78e5c710b8c1c8fcc0a52422c40098bddbacbddd 100644
--- a/content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.cc
+++ b/content/common/gpu/client/gpu_memory_buffer_impl_shared_memory.cc
@@ -35,7 +35,8 @@ scoped_ptr<GpuMemoryBufferImpl> GpuMemoryBufferImplSharedMemory::Create(
     const gfx::Size& size,
     Format format) {
   scoped_ptr<base::SharedMemory> shared_memory(new base::SharedMemory());
-  if (!shared_memory->CreateAnonymous(size.GetArea() * BytesPerPixel(format)))
+  if (!shared_memory->CreateAnonymous(
+          StrideInBytes(size.width(), format) * size.height()))
     return scoped_ptr<GpuMemoryBufferImpl>();
 
   return make_scoped_ptr(new GpuMemoryBufferImplSharedMemory(
@@ -49,9 +50,8 @@ GpuMemoryBufferImplSharedMemory::AllocateForChildProcess(
     const gfx::Size& size,
     Format format,
     base::ProcessHandle child_process) {
-  base::CheckedNumeric<int> buffer_size = size.width();
+  base::CheckedNumeric<int> buffer_size = StrideInBytes(size.width(), format);

[reveman, 2014/12/18 18:49:56]

Can a malicious renderer make this overflow? ie. what if size.width() is
INT_MAX?

[christiank, 2015/01/12 10:35:22]

Should be fixed now that StrideInBytes uses CheckedNumeric internally.

   buffer_size *= size.height();
-  buffer_size *= BytesPerPixel(format);
   if (!buffer_size.IsValid())
     return gfx::GpuMemoryBufferHandle();
 
@@ -101,7 +101,8 @@ bool GpuMemoryBufferImplSharedMemory::IsFormatSupported(Format format) {
 
 void* GpuMemoryBufferImplSharedMemory::Map() {
   DCHECK(!mapped_);
-  if (!shared_memory_->Map(size_.GetArea() * BytesPerPixel(format_)))
+  if (!shared_memory_->Map(
+          StrideInBytes(size_.width(), format_) * size_.height()))
     return NULL;
   mapped_ = true;
   return shared_memory_->memory();
@@ -114,7 +115,7 @@ void GpuMemoryBufferImplSharedMemory::Unmap() {
 }
 
 uint32 GpuMemoryBufferImplSharedMemory::GetStride() const {
-  return size_.width() * BytesPerPixel(format_);
+  return StrideInBytes(size_.width(), format_);
 }
 
 gfx::GpuMemoryBufferHandle GpuMemoryBufferImplSharedMemory::GetHandle() const {