--- a/src/third_party/WebKit/WebCore/rendering/RootInlineBox.cpp
+++ b/src/third_party/WebKit/WebCore/rendering/RootInlineBox.cpp
@@ -233,10 +233,12 @@ int RootInlineBox::verticallyAlignBoxes(
     placeBoxesVertically(heightOfBlock, maxHeight, maxAscent, strictMode, lineTop, lineBottom);
     computeVerticalOverflow(lineTop, lineBottom, strictMode, textBoxDataMap);
     setLineTopBottomPositions(lineTop, lineBottom);
-    
-    heightOfBlock += maxHeight;
-    
-    return heightOfBlock;
+
+    // Detect integer overflow.
+    if (heightOfBlock > numeric_limits<int>::max() - maxHeight)
+        return numeric_limits<int>::max();
+
+    return heightOfBlock + maxHeight;
 }
 
 GapRects RootInlineBox::fillLineSelectionGap(int selTop, int selHeight, RenderBlock* rootBlock, int blockX, int blockY, int tx, int ty,