Update from https://crrev.com/306655

gpu/command_buffer/service/program_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/program_manager.h"
 
 #include <algorithm>
 #include <set>
 #include <utility>
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/metrics/histogram.h"
+#include "base/numerics/safe_math.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/time/time.h"
 #include "gpu/command_buffer/common/gles2_cmd_format.h"
 #include "gpu/command_buffer/common/gles2_cmd_utils.h"
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
 #include "gpu/command_buffer/service/gpu_switches.h"
 #include "gpu/command_buffer/service/program_cache.h"
 #include "gpu/command_buffer/service/shader_manager.h"
 #include "gpu/command_buffer/service/shader_translator.h"
@@ skipping 32 matching lines @@
     return true;
   }
 
   // Look for an array specification.
   size_t open_pos = name.find_last_of('[');
   if (open_pos == std::string::npos ||
       open_pos >= name.size() - 2) {
     return false;
   }
 
-  GLint index = 0;
+  base::CheckedNumeric<GLint> index = 0;
   size_t last = name.size() - 1;
   for (size_t pos = open_pos + 1; pos < last; ++pos) {
     int8 digit = name[pos] - '0';
     if (digit < 0 || digit > 9) {
       return false;
     }
     index = index * 10 + digit;
   }
+  if (!index.IsValid()) {
+    return false;
+  }
 
-  *element_index = index;
+  *element_index = index.ValueOrDie();
   *new_name = name.substr(0, open_pos);
   return true;
 }
 
 bool IsBuiltInFragmentVarying(const std::string& name) {
   // Built-in variables for fragment shaders.
   const char* kBuiltInVaryings[] = {
       "gl_FragCoord",
       "gl_FrontFacing",
       "gl_PointCoord"
@@ skipping 1321 matching lines @@
   DCHECK(program);
   program->ClearUniforms(&zero_);
 }
 
 int32 ProgramManager::MakeFakeLocation(int32 index, int32 element) {
   return index + element * 0x10000;
 }
 
 }  // namespace gles2
 }  // namespace gpu