[Backport] CVE-2023-6345: Integer overflow in Skia

Cherry-pick of patch originally reviewed on
https://skia-review.googlesource.com/c/skia/+/782936:
Avoid combining extremely large meshes.

Bug: chromium:1505053

Fixes: QTBUG-120589
Change-Id: I42f2ff872bbf054686ec7af0cc85ff63055fcfbf
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/528729
Reviewed-by: Michael Brüning <[email protected]>

Author: Michal Klocek

chromium/third_party/skia/src/gpu/ops/GrDrawVerticesOp.cpp

@@ -757,7 +757,11 @@ GrOp::CombineResult DrawVerticesOp::onCombineIfPossible(GrOp* t, GrRecordingCont
         return CombineResult::kCannotCombine;
     }
 
-    if (fVertexCount + that->fVertexCount > SkTo<int>(UINT16_MAX)) {
+    if (fVertexCount > INT32_MAX - that->fVertexCount) {
+        return CombineResult::kCannotCombine;
+    }
+
+    if (fVertexCount > SkTo<int>(UINT16_MAX) - that->fVertexCount) {
         return CombineResult::kCannotCombine;
     }