Fix overflow issue when generateMipmap for srgb texture

gpu/command_buffer/service/gles2_cmd_srgb_converter.cc

Index: gpu/command_buffer/service/gles2_cmd_srgb_converter.cc
diff --git a/gpu/command_buffer/service/gles2_cmd_srgb_converter.cc b/gpu/command_buffer/service/gles2_cmd_srgb_converter.cc
index 5556e9d20739c510b6c51434eff68252f51d2ac1..3e84e3dfcec53321b74b5b7aa76ddabf82a25c36 100644
--- a/gpu/command_buffer/service/gles2_cmd_srgb_converter.cc
+++ b/gpu/command_buffer/service/gles2_cmd_srgb_converter.cc
@@ -423,9 +423,14 @@ void SRGBConverter::GenerateMipmap(const gles2::GLES2Decoder* decoder,
     mipmap_levels =
         TextureManager::ComputeMipMapCount(target, width, height, depth);
   }
-  const GLint max_mipmap_available_levels =
-      (base_level + mipmap_levels) > max_level ? max_level
-                                               : (base_level + mipmap_levels);
+  GLint max_mipmap_available_level;
+  base::CheckedNumeric<GLint> max = base_level;
+  max = max - 1 + mipmap_levels;
+  if (!max.IsValid() || max.ValueOrDie() > max_level) {
+    max_mipmap_available_level = max_level;
+  } else {
+    max_mipmap_available_level = max.ValueOrDie();
+  }
 
   glBindTexture(GL_TEXTURE_2D, srgb_converter_textures_[1]);
   if (feature_info_->ext_color_buffer_float_available() &&
@@ -473,17 +478,19 @@ void SRGBConverter::GenerateMipmap(const gles2::GLES2Decoder* decoder,
 
   // TODO(yizhou): An optimization. Attach 1 level at a time, once for every
   // iteration of the loop.
-  for (GLint level = base_level + 1; level < max_mipmap_available_levels;
+  for (base::CheckedNumeric<GLint> level = base_level + 1;

[Zhenyao Mo, 2017/05/10 17:25:48]

I am not sure if this can catch the overflow.  My understanding is base_level +
1 is computed before assigning to level, so if overflow happens, you simply
assign -1 to level, and level.IsValid() is still true even overflow has
happened.

+       level.IsValid() && level.ValueOrDie() <= max_mipmap_available_level;
        ++level) {
     // copy mipmaps level by level from srgb_converter_textures_[1] to tex
     // generate mipmap for tex manually
     glBindTexture(GL_TEXTURE_2D, tex->service_id());
     if (!tex->IsImmutable()) {
-      glTexImage2D(GL_TEXTURE_2D, level, internal_format, width, height, 0,
-                   format, type, nullptr);
+      glTexImage2D(GL_TEXTURE_2D, level.ValueOrDie(), internal_format, width,
+                   height, 0, format, type, nullptr);
     }
     glFramebufferTexture2DEXT(GL_DRAW_FRAMEBUFFER, GL_COLOR_ATTACHMENT0,
-                              GL_TEXTURE_2D, tex->service_id(), level);
+                              GL_TEXTURE_2D, tex->service_id(),
+                              level.ValueOrDie());
 
     glBindTexture(GL_TEXTURE_2D, srgb_converter_textures_[1]);
     glViewport(0, 0, width, height);