Move SoftwareFrameData overflow checks to the IPC code.

Instead of doing this check in SoftwareFrameManager and silently
dropping the frame, if we have an overflow, drop the IPC from the
renderer (and cause a renderer crash which we can see).

Also move computation code for the frame size in bytes to
SoftwareFrameData so the computation and the check can be beside
each other.

Also add unit tests for SoftwareFrameData IPC.

R=ccameron@chromium.org, jschuh@chromium.org, piman@chromium.org, ccameron, piman
BUG=348332

Review URL: https://codereview.chromium.org/196423027

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@258418 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 3 insertions, 9 deletions

diff --git a/content/browser/renderer_host/software_frame_manager.cc b/content/browser/renderer_host/software_frame_manager.cc
index 387dc00..3630e59 100644
--- a/content/browser/renderer_host/software_frame_manager.cc
+++ b/content/browser/renderer_host/software_frame_manager.cc
@@ -97,15 +97,9 @@ bool SoftwareFrameManager::SwapToNewFrame(
 
   // The NULL handle is used in testing.
   if (base::SharedMemory::IsHandleValid(shared_memory->handle())) {
-    base::CheckedNumeric<size_t> size_in_bytes_checked =
-        base::CheckedNumeric<size_t>(4) *
-        base::CheckedNumeric<size_t>(frame_data->size.width()) *
-        base::CheckedNumeric<size_t>(frame_data->size.height());
-    if (!size_in_bytes_checked.IsValid()) {
-      DLOG(ERROR) << "Integer overflow when computing bytes to map.";
-      return false;
-    }
-    size_t size_in_bytes = size_in_bytes_checked.ValueOrDie();
+    DCHECK(frame_data->CheckedSizeInBytes().IsValid())
+        << "Integer overflow when computing bytes to map.";
+    size_t size_in_bytes = frame_data->SizeInBytes();
 #ifdef OS_WIN
     if (!shared_memory->Map(0)) {
       DLOG(ERROR) << "Unable to map renderer memory.";