From 6ac81c37ea404104d8cc27adf0ef1efe1530f3a7 Mon Sep 17 00:00:00 2001
From: Lee Salzman <lsalzman@mozilla.com>
Date: Tue, 21 Nov 2017 16:55:20 -0500
Subject: [PATCH] Bug 1418447 - Limit Skia edge builder allocations. r=milan

MozReview-Commit-ID: 1SnxwtoYJJm
---
 gfx/skia/skia/src/core/SkEdgeBuilder.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/gfx/skia/skia/src/core/SkEdgeBuilder.cpp b/gfx/skia/skia/src/core/SkEdgeBuilder.cpp
index ceb8f1ad3105..af8da00a2f04 100644
--- a/gfx/skia/skia/src/core/SkEdgeBuilder.cpp
+++ b/gfx/skia/skia/src/core/SkEdgeBuilder.cpp
@@ -248,6 +248,7 @@ int SkEdgeBuilder::buildPoly(const SkPath& path, const SkIRect* iclip, int shift
         // clipping can turn 1 line into (up to) kMaxClippedLineSegments, since
         // we turn portions that are clipped out on the left/right into vertical
         // segments.
+        SkASSERT_RELEASE(maxEdgeCount <= std::numeric_limits<int>::max() / SkLineClipper::kMaxClippedLineSegments);
         maxEdgeCount *= SkLineClipper::kMaxClippedLineSegments;
     }