Fix overflow issue when generateMipmap for srgb texture

gpu/command_buffer/service/gles2_cmd_srgb_converter.cc

 // Copyright (c) 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_srgb_converter.h"
 
 #include "gpu/command_buffer/service/texture_manager.h"
 #include "ui/gl/gl_version_info.h"
 
 namespace {
@@ skipping 405 matching lines @@
   tex->GetLevelSize(target, base_level, &width, &height, &depth);
   tex->GetLevelType(target, base_level, &type, &internal_format);
   format = TextureManager::ExtractFormatFromStorageFormat(internal_format);
   GLint mipmap_levels;
   if (tex->IsImmutable()) {
     mipmap_levels = tex->GetImmutableLevels();
   } else {
     mipmap_levels =
         TextureManager::ComputeMipMapCount(target, width, height, depth);
   }
-  const GLint max_mipmap_available_levels =
-      (base_level + mipmap_levels) > max_level ? max_level
-                                               : (base_level + mipmap_levels);
+  GLint max_mipmap_available_level;
+  base::CheckedNumeric<GLint> max = base_level;
+  max = max - 1 + mipmap_levels;
+  if (!max.IsValid() || max.ValueOrDie() > max_level) {
+    max_mipmap_available_level = max_level;
+  } else {
+    max_mipmap_available_level = max.ValueOrDie();
+  }
 
   glBindTexture(GL_TEXTURE_2D, srgb_converter_textures_[1]);
   if (feature_info_->ext_color_buffer_float_available() &&
       feature_info_->oes_texture_float_linear_available()) {
     glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA32F, width, height, 0, GL_RGBA,
                  GL_FLOAT, nullptr);
   } else {
     glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, width, height, 0, GL_RGBA,
                  GL_UNSIGNED_BYTE, nullptr);
   }
@@ skipping 27 matching lines @@
   glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER, srgb_encoder_fbo_);
   glBindTexture(GL_TEXTURE_2D, srgb_converter_textures_[1]);
   glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER,
                   GL_NEAREST_MIPMAP_NEAREST);
 
   width = (width == 1) ? 1 : width >> 1;
   height = (height == 1) ? 1 : height >> 1;
 
   // TODO(yizhou): An optimization. Attach 1 level at a time, once for every
   // iteration of the loop.
-  for (GLint level = base_level + 1; level < max_mipmap_available_levels;
+  for (base::CheckedNumeric<GLint> level = base_level + 1;

[Zhenyao Mo, 2017/05/10 17:25:48]

I am not sure if this can catch the overflow.  My understanding is base_level +
1 is computed before assigning to level, so if overflow happens, you simply
assign -1 to level, and level.IsValid() is still true even overflow has
happened.

+       level.IsValid() && level.ValueOrDie() <= max_mipmap_available_level;
        ++level) {
     // copy mipmaps level by level from srgb_converter_textures_[1] to tex
     // generate mipmap for tex manually
     glBindTexture(GL_TEXTURE_2D, tex->service_id());
     if (!tex->IsImmutable()) {
-      glTexImage2D(GL_TEXTURE_2D, level, internal_format, width, height, 0,
-                   format, type, nullptr);
+      glTexImage2D(GL_TEXTURE_2D, level.ValueOrDie(), internal_format, width,
+                   height, 0, format, type, nullptr);
     }
     glFramebufferTexture2DEXT(GL_DRAW_FRAMEBUFFER, GL_COLOR_ATTACHMENT0,
-                              GL_TEXTURE_2D, tex->service_id(), level);
+                              GL_TEXTURE_2D, tex->service_id(),
+                              level.ValueOrDie());
 
     glBindTexture(GL_TEXTURE_2D, srgb_converter_textures_[1]);
     glViewport(0, 0, width, height);
     glDrawArrays(GL_TRIANGLES, 0, 6);
     width = (width == 1) ? 1 : width >> 1;
     height = (height == 1) ? 1 : height >> 1;
   }
 
   // Restore state
   decoder->RestoreAllAttributes();
   decoder->RestoreTextureUnitBindings(0);
   decoder->RestoreActiveTexture();
   decoder->RestoreProgramBindings();
   decoder->RestoreBufferBindings();
   decoder->RestoreFramebufferBindings();
   decoder->RestoreGlobalState();
   decoder->RestoreTextureState(tex->service_id());
 }
 
 }  // namespace gles2.
 }  // namespace gpu