generate GL_INVALID_VALUE for CheckedNumeric invalid operations

third_party/WebKit/Source/platform/graphics/gpu/WebGLImageConversion.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "platform/graphics/gpu/WebGLImageConversion.h"
 
 #include "platform/graphics/ImageObserver.h"
 #include "platform/graphics/cpu/arm/WebGLImageConversionNEON.h"
 #include "platform/graphics/cpu/mips/WebGLImageConversionMSA.h"
 #include "platform/graphics/cpu/x86/WebGLImageConversionSSE.h"
@@ skipping 2642 matching lines @@
     CheckedNumeric<uint32_t> tmp = width;
     tmp *= bytesPerGroup;
     if (!tmp.IsValid())
       return GL_INVALID_VALUE;
     lastRowSize = tmp.ValueOrDie();
   } else {
     lastRowSize = checkedValue.ValueOrDie();
   }
 
   unsigned padding = 0;
-  unsigned residual = (checkedValue % params.alignment).ValueOrDie();
+  CheckedNumeric<uint32_t> checkedResidual = checkedValue % params.alignment;
+  if (!checkedResidual.IsValid()) {
+    return GL_INVALID_VALUE;
+  }
+  unsigned residual = checkedResidual.ValueOrDie();
   if (residual) {
     padding = params.alignment - residual;
     checkedValue += padding;
   }
   if (!checkedValue.IsValid())
     return GL_INVALID_VALUE;
   unsigned paddedRowSize = checkedValue.ValueOrDie();
 
   CheckedNumeric<uint32_t> rows = imageHeight;
   rows *= (depth - 1);
@@ skipping 490 matching lines @@
       pack<WebGLImageConversion::DataFormatRGB565,
            WebGLImageConversion::AlphaDoNothing>(srcRowStart, dstRowStart,
                                                  pixelsPerRow);
     } break;
     default:
       break;
   }
 }
 
 }  // namespace blink