Fix overflow issue when generateMipmap for srgb texture

gpu/command_buffer/service/gles2_cmd_srgb_converter.cc

Index: gpu/command_buffer/service/gles2_cmd_srgb_converter.cc
diff --git a/gpu/command_buffer/service/gles2_cmd_srgb_converter.cc b/gpu/command_buffer/service/gles2_cmd_srgb_converter.cc
index 5556e9d20739c510b6c51434eff68252f51d2ac1..73f399172642dd29bbafa38963b8dda3fed939c1 100644
--- a/gpu/command_buffer/service/gles2_cmd_srgb_converter.cc
+++ b/gpu/command_buffer/service/gles2_cmd_srgb_converter.cc
@@ -423,9 +423,14 @@ void SRGBConverter::GenerateMipmap(const gles2::GLES2Decoder* decoder,
     mipmap_levels =
         TextureManager::ComputeMipMapCount(target, width, height, depth);
   }
-  const GLint max_mipmap_available_levels =
-      (base_level + mipmap_levels) > max_level ? max_level
-                                               : (base_level + mipmap_levels);
+  GLint max_mipmap_available_level;
+  base::CheckedNumeric<GLint> max = base_level;
+  max = max - 1 + mipmap_levels;
+  if (!max.IsValid() || max.ValueOrDie() > max_level) {
+    max_mipmap_available_level = max_level;
+  } else {
+    max_mipmap_available_level = max.ValueOrDie();
+  }
 
   glBindTexture(GL_TEXTURE_2D, srgb_converter_textures_[1]);
   if (feature_info_->ext_color_buffer_float_available() &&
@@ -473,7 +478,7 @@ void SRGBConverter::GenerateMipmap(const gles2::GLES2Decoder* decoder,
 
   // TODO(yizhou): An optimization. Attach 1 level at a time, once for every
   // iteration of the loop.
-  for (GLint level = base_level + 1; level < max_mipmap_available_levels;
+  for (GLint level = base_level + 1; level <= max_mipmap_available_level;

[Zhenyao Mo, 2017/05/09 17:14:33]

Sorry I failed to mention this earlier, but base_level + 1 and level ++ can also
overflow.

[yizhou.jiang, 2017/05/10 08:28:49]

Done.

        ++level) {
     // copy mipmaps level by level from srgb_converter_textures_[1] to tex
     // generate mipmap for tex manually