generate GL_INVALID_VALUE for CheckedNumeric invalid operations

third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp

Index: third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
index 091e6287e8103a43fe42601ff7b03ad7f1d322f9..48237e05f658eacf2d4baa361af9e695385d61e6 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
@@ -4101,9 +4101,14 @@ void WebGLRenderingContextBase::readPixelsHelper(GLint x,
     synthesizeGLError(GL_INVALID_FRAMEBUFFER_OPERATION, "readPixels", reason);
     return;
   }
-  if (!validateReadPixelsFuncParameters(
-          width, height, format, type, pixels,
-          (pixels->byteLength() - offsetInBytes).ValueOrDie())) {
+  CheckedNumeric<GLuint> bufferSize = pixels->byteLength() - offsetInBytes;
+  if (!bufferSize.IsValid()) {
+    synthesizeGLError(GL_INVALID_VALUE, "readPixels",
+                      "destination offset out of range");
+    return;
+  }
+  if (!validateReadPixelsFuncParameters(width, height, format, type, pixels,
+                                        bufferSize.ValueOrDie())) {
     return;
   }
   clearIfComposited();