diff --git a/gfx/skia/skia/src/core/SkRegion.cpp b/gfx/skia/skia/src/core/SkRegion.cpp index 2e35bfe48f5f..0c16d6147b40 100644 --- a/gfx/skia/skia/src/core/SkRegion.cpp +++ b/gfx/skia/skia/src/core/SkRegion.cpp @@ -61,7 +61,9 @@ public: void resizeToAtLeast(int count) { if (count > fCount) { // leave at least 50% extra space for future growth. - count += count >> 1; + SkSafeMath safe; + int newCount = safe.addInt(count, count >> 1); + count = safe ? newCount : SK_MaxS32; fMalloc.realloc(count); if (fPtr == fStack) { memcpy(fMalloc.get(), fStack, fCount * sizeof(SkRegionPriv::RunType));