Update from https://crrev.com/318214

skia/ext/skia_utils_ios.mm

Index: skia/ext/skia_utils_ios.mm
diff --git a/skia/ext/skia_utils_ios.mm b/skia/ext/skia_utils_ios.mm
index 3ae962cd59e55469561b3a1f1670a6096a3efc66..5655d22a5627ef98a19b4d07739d2fa86447346d 100644
--- a/skia/ext/skia_utils_ios.mm
+++ b/skia/ext/skia_utils_ios.mm
@@ -7,10 +7,26 @@
 #import <ImageIO/ImageIO.h>
 #import <UIKit/UIKit.h>
 
+#include "base/ios/ios_util.h"
 #include "base/logging.h"
 #include "base/mac/scoped_cftyperef.h"
+#include "base/macros.h"
 #include "third_party/skia/include/utils/mac/SkCGUtils.h"
 
+namespace {
+
+const uint8 kICOHeaderMagic[4] = {0x00, 0x00, 0x01, 0x00};
+
+// Returns whether the data encodes an ico image.
+bool EncodesIcoImage(NSData* image_data) {
+  if (image_data.length < arraysize(kICOHeaderMagic))
+    return false;
+  return memcmp(kICOHeaderMagic, image_data.bytes,
+                arraysize(kICOHeaderMagic)) == 0;
+}
+
+}  // namespace
+
 namespace gfx {
 
 SkBitmap CGImageToSkBitmap(CGImageRef image, CGSize size, bool is_opaque) {
@@ -74,6 +90,12 @@ UIImage* SkBitmapToUIImageWithColorSpace(const SkBitmap& skia_bitmap,
 
 std::vector<SkBitmap> ImageDataToSkBitmaps(NSData* image_data) {
   DCHECK(image_data);
+
+  // On iOS 8.1.1 |CGContextDrawImage| crashes when processing images included
+  // in .ico files that are 88x88 pixels or larger (http://crbug.com/435068).
+  bool skip_images_88x88_or_larger =
+      base::ios::IsRunningOnOrLater(8, 1, 1) && EncodesIcoImage(image_data);
+
   base::ScopedCFTypeRef<CFDictionaryRef> empty_dictionary(
       CFDictionaryCreate(NULL, NULL, NULL, 0, NULL, NULL));
   std::vector<SkBitmap> frames;
@@ -88,6 +110,9 @@ std::vector<SkBitmap> ImageDataToSkBitmaps(NSData* image_data) {
 
     CGSize size = CGSizeMake(CGImageGetWidth(cg_image),
                              CGImageGetHeight(cg_image));
+    if (size.width >= 88 && size.height >= 88 && skip_images_88x88_or_larger)
+      continue;
+
     const SkBitmap bitmap = CGImageToSkBitmap(cg_image, size, false);
     if (!bitmap.empty())
       frames.push_back(bitmap);