Fix silent truncations when extracting values from CheckedNumeric

ui/gfx/buffer_format_util.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/gfx/buffer_format_util.h"
 
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/numerics/safe_math.h"
 
@@ skipping 35 matching lines @@
     case BufferFormat::DXT1:
     case BufferFormat::ETC1:
       DCHECK_EQ(0u, plane);
       DCHECK_EQ(0u, width % 2);
       *size_in_bytes = width / 2;
       return true;
     case BufferFormat::R_8:
       checked_size += 3;
       if (!checked_size.IsValid())
         return false;
-      *size_in_bytes = checked_size.ValueOrDie() & ~0x3;
+      *size_in_bytes = (checked_size & ~0x3).ValueOrDie();
       return true;
     case BufferFormat::RG_88:
     case BufferFormat::BGR_565:
     case BufferFormat::RGBA_4444:
     case BufferFormat::UYVY_422:
       checked_size *= 2;
       checked_size += 3;
       if (!checked_size.IsValid())
         return false;
-      *size_in_bytes = checked_size.ValueOrDie() & ~0x3;
+      *size_in_bytes = (checked_size & ~0x3).ValueOrDie();
       return true;
     case BufferFormat::BGRX_8888:
     case BufferFormat::RGBX_8888:
     case BufferFormat::RGBA_8888:
     case BufferFormat::BGRA_8888:
       checked_size *= 4;
       if (!checked_size.IsValid())
         return false;
-      *size_in_bytes = checked_size.ValueOrDie();
+      *size_in_bytes = (checked_size & ~0x3).ValueOrDie();
       return true;
     case BufferFormat::YVU_420:
       DCHECK_EQ(0u, width % 2);
       *size_in_bytes = width / SubsamplingFactorForBufferFormat(format, plane);
       return true;
     case BufferFormat::YUV_420_BIPLANAR:
       DCHECK_EQ(width % 2, 0u);
       *size_in_bytes = width;
       return true;
   }
@@ skipping 133 matching lines @@
       DCHECK_LT(plane, arraysize(offset_in_2x2_sub_sampling_sizes));
       return offset_in_2x2_sub_sampling_sizes[plane] *
              (size.width() / 2 + size.height() / 2);
     }
   }
   NOTREACHED();
   return 0;
 }
 
 }  // namespace gfx