Fix numeric overflow in layer area calculation

BUG=1116788

Change-Id: I60c721d84b7c21406259ad8345d0290cb52ee940
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2358603
Commit-Queue: Stefan Zager <szager@chromium.org>
Reviewed-by: Philip Rogers <pdr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#799290}

third_party/blink/renderer/core/paint/table_row_painter.cc

@@ -109,10 +109,12 @@ void TableRowPainter::PaintBoxDecorationBackground(
             paint_info_for_cells, layout_table_row_);
       }
     }
+    uint64_t paint_area = base::saturated_cast<uint64_t>(
+        paint_rect.Width().ToUnsigned() * paint_rect.Height().ToUnsigned());
     paint_info.context.GetPaintController().SetPossibleBackgroundColor(
         layout_table_row_,
         layout_table_row_.ResolveColor(GetCSSPropertyBackgroundColor()).Rgb(),
-        paint_rect.Width().ToUnsigned() * paint_rect.Height().ToUnsigned());
+        paint_area);
   }
 
   if (has_box_shadow) {

third_party/blink/renderer/core/paint/table_section_painter.cc

@@ -307,11 +307,13 @@ void TableSectionPainter::PaintBoxDecorationBackground(
         }
       }
     }
+    uint64_t paint_area = base::saturated_cast<uint64_t>(
+        paint_rect.Width().ToUnsigned() * paint_rect.Height().ToUnsigned());
     paint_info.context.GetPaintController().SetPossibleBackgroundColor(
         layout_table_section_,
         layout_table_section_.ResolveColor(GetCSSPropertyBackgroundColor())
             .Rgb(),
-        paint_rect.Width().ToUnsigned() * paint_rect.Height().ToUnsigned());
+        paint_area);
   }
 
   if (has_box_shadow) {

third_party/blink/renderer/platform/graphics/paint/drawing_display_item.cc

@@ -111,7 +111,8 @@ SkColor DrawingDisplayItem::BackgroundColor(uint64_t& area) const {
       default:
         continue;
     }
-    area = static_cast<uint64_t>(item_rect.width() * item_rect.height());
+    area =
+        base::saturated_cast<uint64_t>(item_rect.width() * item_rect.height());
     return flags.getColor();
   }
   return SK_ColorTRANSPARENT;

third_party/blink/renderer/platform/graphics/paint/paint_artifact.cc

@@ -123,8 +123,9 @@ void PaintArtifact::UpdateBackgroundColor(
 
   layer->SetSafeOpaqueBackgroundColor(color);
 
-  uint64_t layer_area = layer->bounds().width() * layer->bounds().height();
-  if (area < layer_area / 2)
+  base::ClampedNumeric<uint64_t> layer_area = layer->bounds().width();
+  layer_area *= layer->bounds().height();
+  if (area < static_cast<uint64_t>(layer_area) / 2)
     color = SK_ColorTRANSPARENT;
   layer->SetBackgroundColor(color);
 }