Merge pull request #2904 from DarDoro/master

floodFill buffer overflow prevention, issue #2903

src/objects.js

@@ -5572,8 +5572,8 @@ SpriteMorph.prototype.floodFill = function () {
         img = ctx.getImageData(0, 0, width, height),
         dta = img.data,
         stack = [
-            Math.round((height / 2) - this.yPosition()) * width +
-            Math.round(this.xPosition() + (width / 2))
+            Math.floor((height / 2) - this.yPosition()) * width +
+            Math.floor(this.xPosition() + (width / 2))
         ],
         current,
         src;