Fix silent truncations when extracting values from CheckedNumeric

third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 4083 matching lines @@
   const char* reason = "framebuffer incomplete";
   WebGLFramebuffer* framebuffer = getReadFramebufferBinding();
   if (framebuffer &&
       framebuffer->checkDepthStencilStatus(&reason) !=
           GL_FRAMEBUFFER_COMPLETE) {
     synthesizeGLError(GL_INVALID_FRAMEBUFFER_OPERATION, "readPixels", reason);
     return;
   }
   if (!validateReadPixelsFuncParameters(
           width, height, format, type, pixels,
-          static_cast<long long>(pixels->byteLength() -
-                                 offsetInBytes.ValueOrDie()))) {
+          static_cast<long long>(
+              (pixels->byteLength() - offsetInBytes).ValueOrDie()))) {
     return;
   }
   clearIfComposited();
   uint8_t* data =
       static_cast<uint8_t*>(pixels->baseAddress()) + offsetInBytes.ValueOrDie();
   {
     ScopedDrawingBufferBinder binder(drawingBuffer(), framebuffer);
     contextGL()->ReadPixels(x, y, width, height, format, type, data);
   }
 }
@@ skipping 3645 matching lines @@
 
 void WebGLRenderingContextBase::getHTMLOrOffscreenCanvas(
     HTMLCanvasElementOrOffscreenCanvas& result) const {
   if (canvas())
     result.setHTMLCanvasElement(canvas());
   else
     result.setOffscreenCanvas(getOffscreenCanvas());
 }
 
 }  // namespace blink