From: Jim Blandy <jimb@mozilla.com>
Subject: Saturate when rounding up trapezoid edges

diff --git a/pixman/pixman-edge-imp.h b/pixman/pixman-edge-imp.h
index a4698eddb281..39e8d71d2568 100644
--- a/pixman/pixman-edge-imp.h
+++ b/pixman/pixman-edge-imp.h
@@ -53,10 +53,13 @@ RASTERIZE_EDGES (pixman_image_t  *image,
 	 * when the sample point lies exactly on the line, we round towards
 	 * north-west.
 	 *
+	 * Use 64 bits to get a saturating add, in case lx or rx are near
+	 * the limits of pixman_fixed_t.
+	 *
 	 * (The AA case does a similar  adjustment in RENDER_SAMPLES_X)
 	 */
-	lx += X_FRAC_FIRST(1) - pixman_fixed_e;
-	rx += X_FRAC_FIRST(1) - pixman_fixed_e;
+	lx = (pixman_fixed_t) MIN ((int64_t) lx + (X_FRAC_FIRST(1) - pixman_fixed_e), INT32_MAX);
+	rx = (pixman_fixed_t) MIN ((int64_t) rx + (X_FRAC_FIRST(1) - pixman_fixed_e), INT32_MAX);
 #endif
 	/* clip X */
 	if (lx < 0)