--- a/xpcom/glue/nsDeque.cpp
+++ b/xpcom/glue/nsDeque.cpp
@@ -6,16 +6,18 @@
 
 #include "nsDeque.h"
 #include "nsISupportsImpl.h"
 #include <string.h>
 #ifdef DEBUG_rickg
 #include <stdio.h>
 #endif
 
+#include "mozilla/CheckedInt.h"
+
 /**
  * 07/02/2001  09:17p 509,104 clangref.pdf from openwatcom's site
  * Watcom C Language Reference Edition 11.0c
  * page 118 of 297
  *
  * The % symbol yields the remainder from the division of the first operand
  * by the second operand. The operands of % must have integral type.
  *
@@ -158,39 +160,51 @@ nsDeque::Erase()
  * Elements in the deque are resequenced so that elements
  * in the deque are stored sequentially
  *
  * @return  whether growing succeeded
  */
 bool
 nsDeque::GrowCapacity()
 {
-  int32_t theNewSize = mCapacity << 2;
-  NS_ASSERTION(theNewSize > mCapacity, "Overflow");
-  if (theNewSize <= mCapacity) {
+  mozilla::CheckedInt<int32_t> newCapacity = mCapacity;
+  newCapacity *= 4;
+
+  NS_ASSERTION(newCapacity.isValid(), "Overflow");
+  if (!newCapacity.isValid()) {
     return false;
   }
-  void** temp = (void**)malloc(theNewSize * sizeof(void*));
+
+  // Sanity check the new byte size.
+  mozilla::CheckedInt<int32_t> newByteSize = newCapacity;
+  newByteSize *= sizeof(void*);
+
+  NS_ASSERTION(newByteSize.isValid(), "Overflow");
+  if (!newByteSize.isValid()) {
+    return false;
+  }
+
+  void** temp = (void**)malloc(newByteSize.value());
   if (!temp) {
     return false;
   }
 
   //Here's the interesting part: You can't just move the elements
   //directly (in situ) from the old buffer to the new one.
   //Since capacity has changed, the old origin doesn't make
   //sense anymore. It's better to resequence the elements now.
 
   memcpy(temp, mData + mOrigin, sizeof(void*) * (mCapacity - mOrigin));
   memcpy(temp + (mCapacity - mOrigin), mData, sizeof(void*) * mOrigin);
 
   if (mData != mBuffer) {
     free(mData);
   }
 
-  mCapacity = theNewSize;
+  mCapacity = newCapacity.value();
   mOrigin = 0; //now realign the origin...
   mData = temp;
 
   return true;
 }
 
 /**
  * This method adds an item to the end of the deque.