[Backport] Security bug 905509 (13/13)

Manual backport of original patch by Zhenyao Mo <zmo@chromium.org>:
Remove Safe* math helper functions in gpu command buffer

The base::Check* function semantics are better.

BUG=905509
TEST=gpu_unittests
R=piman@chromium.org

Change-Id: Ide79451ade00bb6c76cff72ebbacf112b3497b72
Reviewed-on: https://chromium-review.googlesource.com/c/1408031
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

14 files changed, 129 insertions, 224 deletions

diff --git a/chromium/gpu/command_buffer/build_cmd_buffer_lib.py b/chromium/gpu/command_buffer/build_cmd_buffer_lib.py
index 72602b2d01e..6284959ae75 100644
--- a/chromium/gpu/command_buffer/build_cmd_buffer_lib.py
+++ b/chromium/gpu/command_buffer/build_cmd_buffer_lib.py
@@ -2186,7 +2186,7 @@ class GENnHandler(TypeHandler):
   def WriteGetDataSizeCode(self, func, f):
     """Overrriden from TypeHandler."""
     code = """  uint32_t data_size;
-  if (!%sSafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&%(data_size)s)) {
     return error::kOutOfBounds;
   }
 """ % _Namespace()
@@ -2638,7 +2638,7 @@ class DELnHandler(TypeHandler):
   def WriteGetDataSizeCode(self, func, f):
     """Overrriden from TypeHandler."""
     code = """  uint32_t data_size;
-  if (!%sSafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&%(data_size)s)) {
     return error::kOutOfBounds;
   }
 """ % _Namespace()
diff --git a/chromium/gpu/command_buffer/client/gles2_implementation.cc b/chromium/gpu/command_buffer/client/gles2_implementation.cc
index 511e087d5da..f43d3760533 100644
--- a/chromium/gpu/command_buffer/client/gles2_implementation.cc
+++ b/chromium/gpu/command_buffer/client/gles2_implementation.cc
@@ -2069,7 +2069,8 @@ void GLES2Implementation::BufferSubDataHelper(
 
     int32_t end = 0;
     int32_t buffer_size = buffer->size();
-    if (!SafeAddInt32(offset, size, &end) || end > buffer_size) {
+    if (!base::CheckAdd(offset, size).AssignIfValid(&end) ||
+        end > buffer_size) {
       SetGLError(GL_INVALID_VALUE, "glBufferSubData", "out of range");
       return;
     }
@@ -4559,7 +4560,10 @@ void GLES2Implementation::DrawArrays(GLenum mode, GLint first, GLsizei count) {
   bool simulated = false;
   if (vertex_array_object_manager_->SupportsClientSideBuffers()) {
     GLsizei num_elements;
-    SafeAddInt32(first, count, &num_elements);
+    if (!base::CheckAdd(first, count).AssignIfValid(&num_elements)) {
+      SetGLError(GL_INVALID_VALUE, "glDrawArrays", "first+count overflow");
+      return;
+    }
     if (!vertex_array_object_manager_->SetupSimulatedClientSideBuffers(
             "glDrawArrays", this, helper_, num_elements, 0, &simulated)) {
       return;
@@ -5805,7 +5809,11 @@ void GLES2Implementation::DrawArraysInstancedANGLE(
   bool simulated = false;
   if (vertex_array_object_manager_->SupportsClientSideBuffers()) {
     GLsizei num_elements;
-    SafeAddInt32(first, count, &num_elements);
+    if (!base::CheckAdd(first, count).AssignIfValid(&num_elements)) {
+      SetGLError(GL_INVALID_VALUE, "glDrawArraysInstancedANGLE",
+                 "first+count overflow");
+      return;
+    }
     if (!vertex_array_object_manager_->SetupSimulatedClientSideBuffers(
             "glDrawArraysInstancedANGLE", this, helper_, num_elements,
             primcount, &simulated)) {
@@ -6550,7 +6558,8 @@ void GLES2Implementation::DeletePathsCHROMIUM(GLuint first_client_id,
     return;
 
   GLuint last_client_id;
-  if (!SafeAddUint32(first_client_id, range - 1, &last_client_id)) {
+  if (!base::CheckAdd(first_client_id, range - 1)
+           .AssignIfValid(&last_client_id)) {
     SetGLError(GL_INVALID_OPERATION, kFunctionName, "overflow");
     return;
   }
@@ -6615,13 +6624,15 @@ void GLES2Implementation::PathCommandsCHROMIUM(GLuint path,
   }
 
   uint32_t coords_size;
-  if (!SafeMultiplyUint32(num_coords, coord_type_size, &coords_size)) {
+  if (!base::CheckMul(num_coords, coord_type_size)
+           .AssignIfValid(&coords_size)) {
     SetGLError(GL_INVALID_OPERATION, kFunctionName, "overflow");
     return;
   }
 
   uint32_t required_buffer_size;
-  if (!SafeAddUint32(coords_size, num_commands, &required_buffer_size)) {
+  if (!base::CheckAdd(coords_size, num_commands)
+           .AssignIfValid(&required_buffer_size)) {
     SetGLError(GL_INVALID_OPERATION, kFunctionName, "overflow");
     return;
   }
@@ -6711,7 +6722,7 @@ bool GLES2Implementation::PrepareInstancedPathCommand(
   }
 
   uint32_t paths_size;
-  if (!SafeMultiplyUint32(path_name_size, num_paths, &paths_size)) {
+  if (!base::CheckMul(path_name_size, num_paths).AssignIfValid(&paths_size)) {
     SetGLError(GL_INVALID_OPERATION, function_name, "overflow");
     return false;
   }
@@ -6721,13 +6732,15 @@ bool GLES2Implementation::PrepareInstancedPathCommand(
   uint32_t one_transform_size = sizeof(GLfloat) * transforms_component_count;
 
   uint32_t transforms_size;
-  if (!SafeMultiplyUint32(one_transform_size, num_paths, &transforms_size)) {
+  if (!base::CheckMul(one_transform_size, num_paths)
+           .AssignIfValid(&transforms_size)) {
     SetGLError(GL_INVALID_OPERATION, function_name, "overflow");
     return false;
   }
 
   uint32_t required_buffer_size;
-  if (!SafeAddUint32(transforms_size, paths_size, &required_buffer_size)) {
+  if (!base::CheckAdd(transforms_size, paths_size)
+           .AssignIfValid(&required_buffer_size)) {
     SetGLError(GL_INVALID_OPERATION, function_name, "overflow");
     return false;
   }
diff --git a/chromium/gpu/command_buffer/common/gles2_cmd_utils.cc b/chromium/gpu/command_buffer/common/gles2_cmd_utils.cc
index 1f623eaf070..c7a98f9e873 100644
--- a/chromium/gpu/command_buffer/common/gles2_cmd_utils.cc
+++ b/chromium/gpu/command_buffer/common/gles2_cmd_utils.cc
@@ -586,7 +586,8 @@ bool GLES2Util::ComputeImageRowSizeHelper(int width,
   DCHECK(alignment == 1 || alignment == 2 ||
          alignment == 4 || alignment == 8);
   uint32_t unpadded_row_size;
-  if (!SafeMultiplyUint32(width, bytes_per_group, &unpadded_row_size)) {
+  if (!base::CheckMul(width, bytes_per_group)
+           .AssignIfValid(&unpadded_row_size)) {
     return false;
   }
   uint32_t residual = unpadded_row_size % alignment;
@@ -594,7 +595,8 @@ bool GLES2Util::ComputeImageRowSizeHelper(int width,
   uint32_t padded_row_size = unpadded_row_size;
   if (residual > 0) {
     padding = alignment - residual;
-    if (!SafeAddUint32(unpadded_row_size, padding, &padded_row_size)) {
+    if (!base::CheckAdd(unpadded_row_size, padding)
+             .AssignIfValid(&padded_row_size)) {
       return false;
     }
   }
@@ -664,8 +666,8 @@ bool GLES2Util::ComputeImageDataSizesES3(
   int image_height = params.image_height > 0 ? params.image_height : height;
   uint32_t num_of_rows;
   if (depth > 0) {
-    if (!SafeMultiplyUint32(image_height, depth - 1, &num_of_rows) ||
-        !SafeAddUint32(num_of_rows, height, &num_of_rows)) {
+    if (!base::CheckAdd(base::CheckMul(image_height, depth - 1), height)
+             .AssignIfValid(&num_of_rows)) {
       return false;
     }
   } else {
@@ -673,42 +675,28 @@ bool GLES2Util::ComputeImageDataSizesES3(
   }
 
   if (num_of_rows > 0) {
-    uint32_t size_of_all_but_last_row;
-    if (!SafeMultiplyUint32((num_of_rows - 1), padded_row_size,
-                            &size_of_all_but_last_row)) {
-      return false;
-    }
-    if (!SafeAddUint32(size_of_all_but_last_row, unpadded_row_size, size)) {
+    if (!base::CheckAdd(base::CheckMul(num_of_rows - 1, padded_row_size),
+                        unpadded_row_size)
+             .AssignIfValid(size)) {
       return false;
     }
   } else {
     *size = 0;
   }
 
-  uint32_t skip_size = 0;
+  base::CheckedNumeric<uint32_t> skip_size = 0;
   if (params.skip_images > 0) {
-    uint32_t image_size;
-    if (!SafeMultiplyUint32(image_height, padded_row_size, &image_size))
-      return false;
-    if (!SafeMultiplyUint32(image_size, params.skip_images, &skip_size))
-      return false;
+    skip_size = image_height;
+    skip_size *= padded_row_size;
+    skip_size *= params.skip_images;
   }
   if (params.skip_rows > 0) {
-    uint32_t temp;
-    if (!SafeMultiplyUint32(padded_row_size, params.skip_rows, &temp))
-      return false;
-    if (!SafeAddUint32(skip_size, temp, &skip_size))
-      return false;
+    skip_size += base::CheckMul(padded_row_size, params.skip_rows);
   }
   if (params.skip_pixels > 0) {
-    uint32_t temp;
-    if (!SafeMultiplyUint32(bytes_per_group, params.skip_pixels, &temp))
-      return false;
-    if (!SafeAddUint32(skip_size, temp, &skip_size))
-      return false;
+    skip_size += base::CheckMul(bytes_per_group, params.skip_pixels);
   }
-  uint32_t total_size;
-  if (!SafeAddUint32(*size, skip_size, &total_size))
+  if (!base::CheckAdd(*size, skip_size).IsValid())
     return false;
 
   if (opt_padded_row_size) {
@@ -718,7 +706,7 @@ bool GLES2Util::ComputeImageDataSizesES3(
     *opt_unpadded_row_size = unpadded_row_size;
   }
   if (opt_skip_size)
-    *opt_skip_size = skip_size;
+    *opt_skip_size = skip_size.ValueOrDefault(0);
   return true;
 }
 
diff --git a/chromium/gpu/command_buffer/common/gles2_cmd_utils.h b/chromium/gpu/command_buffer/common/gles2_cmd_utils.h
index 685223f022c..46a48746c5b 100644
--- a/chromium/gpu/command_buffer/common/gles2_cmd_utils.h
+++ b/chromium/gpu/command_buffer/common/gles2_cmd_utils.h
@@ -22,37 +22,6 @@
 namespace gpu {
 namespace gles2 {
 
-// Does a multiply and checks for overflow.  If the multiply did not overflow
-// returns true.
-
-// Multiplies 2 32 bit unsigned numbers checking for overflow.
-// If there was no overflow returns true.
-inline bool SafeMultiplyUint32(uint32_t a, uint32_t b, uint32_t* dst) {
-  DCHECK(dst);
-  base::CheckedNumeric<uint32_t> checked = a;
-  checked *= b;
-  *dst = checked.ValueOrDefault(0);
-  return checked.IsValid();
-}
-
-// Does an add checking for overflow.  If there was no overflow returns true.
-inline bool SafeAddUint32(uint32_t a, uint32_t b, uint32_t* dst) {
-  DCHECK(dst);
-  base::CheckedNumeric<uint32_t> checked = a;
-  checked += b;
-  *dst = checked.ValueOrDefault(0);
-  return checked.IsValid();
-}
-
-// Does an add checking for overflow.  If there was no overflow returns true.
-inline bool SafeAddInt32(int32_t a, int32_t b, int32_t* dst) {
-  DCHECK(dst);
-  base::CheckedNumeric<int32_t> checked = a;
-  checked += b;
-  *dst = checked.ValueOrDefault(0);
-  return checked.IsValid();
-}
-
 // Returns the address of the first byte after a struct.
 template <typename T>
 const volatile void* AddressAfterStruct(const volatile T& pod) {
diff --git a/chromium/gpu/command_buffer/common/gles2_cmd_utils_unittest.cc b/chromium/gpu/command_buffer/common/gles2_cmd_utils_unittest.cc
index 459e39e408f..993d6e6a758 100644
--- a/chromium/gpu/command_buffer/common/gles2_cmd_utils_unittest.cc
+++ b/chromium/gpu/command_buffer/common/gles2_cmd_utils_unittest.cc
@@ -21,58 +21,6 @@ class GLES2UtilTest : public testing:: Test {
   GLES2Util util_;
 };
 
-TEST_F(GLES2UtilTest, SafeMultiplyUint32) {
-  uint32_t result = 0;
-  EXPECT_TRUE(SafeMultiplyUint32(2u, 3u, &result));
-  EXPECT_EQ(6u, result);
-  EXPECT_FALSE(SafeMultiplyUint32(0x80000000u, 2u, &result));
-  EXPECT_EQ(0u, result);
-  EXPECT_TRUE(SafeMultiplyUint32(0x2u, 0x7FFFFFFFu, &result));
-  EXPECT_EQ(0xFFFFFFFEu, result);
-  EXPECT_FALSE(SafeMultiplyUint32(2u, 0x80000000u, &result));
-  EXPECT_EQ(0u, result);
-}
-
-TEST_F(GLES2UtilTest, SafeAddUint32) {
-  uint32_t result = 0;
-  EXPECT_TRUE(SafeAddUint32(2u, 3u, &result));
-  EXPECT_EQ(5u, result);
-  EXPECT_FALSE(SafeAddUint32(0x80000000u, 0x80000000u, &result));
-  EXPECT_EQ(0u, result);
-  EXPECT_TRUE(SafeAddUint32(0xFFFFFFFEu, 0x1u, &result));
-  EXPECT_EQ(0xFFFFFFFFu, result);
-  EXPECT_FALSE(SafeAddUint32(0xFFFFFFFEu, 0x2u, &result));
-  EXPECT_EQ(0u, result);
-  EXPECT_TRUE(SafeAddUint32(0x1u, 0xFFFFFFFEu, &result));
-  EXPECT_EQ(0xFFFFFFFFu, result);
-  EXPECT_FALSE(SafeAddUint32(0x2u, 0xFFFFFFFEu, &result));
-  EXPECT_EQ(0u, result);
-}
-
-TEST_F(GLES2UtilTest, SafeAddInt32) {
-  int32_t result = 0;
-  const int32_t kMax = std::numeric_limits<int32_t>::max();
-  const int32_t kMin = std::numeric_limits<int32_t>::min();
-  EXPECT_TRUE(SafeAddInt32(2, 3, &result));
-  EXPECT_EQ(5, result);
-  EXPECT_FALSE(SafeAddInt32(kMax, 1, &result));
-  EXPECT_EQ(0, result);
-  EXPECT_TRUE(SafeAddInt32(kMin + 1, -1, &result));
-  EXPECT_EQ(kMin, result);
-  EXPECT_FALSE(SafeAddInt32(kMin, -1, &result));
-  EXPECT_EQ(0, result);
-  EXPECT_TRUE(SafeAddInt32(kMax - 1, 1, &result));
-  EXPECT_EQ(kMax, result);
-  EXPECT_FALSE(SafeAddInt32(1, kMax, &result));
-  EXPECT_EQ(0, result);
-  EXPECT_TRUE(SafeAddInt32(-1, kMin + 1, &result));
-  EXPECT_EQ(kMin, result);
-  EXPECT_FALSE(SafeAddInt32(-1, kMin, &result));
-  EXPECT_EQ(0, result);
-  EXPECT_TRUE(SafeAddInt32(1, kMax - 1, &result));
-  EXPECT_EQ(kMax, result);
-}
-
 TEST_F(GLES2UtilTest, GLGetNumValuesReturned) {
   EXPECT_EQ(0, util_.GLGetNumValuesReturned(GL_COMPRESSED_TEXTURE_FORMATS));
   EXPECT_EQ(0, util_.GLGetNumValuesReturned(GL_SHADER_BINARY_FORMATS));
diff --git a/chromium/gpu/command_buffer/service/buffer_manager.cc b/chromium/gpu/command_buffer/service/buffer_manager.cc
index 4276bf81266..5bb00ef69a1 100644
--- a/chromium/gpu/command_buffer/service/buffer_manager.cc
+++ b/chromium/gpu/command_buffer/service/buffer_manager.cc
@@ -10,12 +10,11 @@
 
 #include "base/format_macros.h"
 #include "base/logging.h"
-#include "base/numerics/safe_math.h"
+#include "base/numerics/checked_math.h"
 #include "base/strings/stringprintf.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/trace_event/memory_dump_manager.h"
 #include "base/trace_event/trace_event.h"
-#include "gpu/command_buffer/common/gles2_cmd_utils.h"
 #include "gpu/command_buffer/service/context_state.h"
 #include "gpu/command_buffer/service/error_state.h"
 #include "gpu/command_buffer/service/feature_info.h"
@@ -210,9 +209,8 @@ bool Buffer::CheckRange(GLintptr offset, GLsizeiptr size) const {
       size < 0 || size > std::numeric_limits<int32_t>::max()) {
     return false;
   }
-  base::CheckedNumeric<int32_t> max = offset;
-  max += size;
-  return max.IsValid() && max.ValueOrDefault(0) <= size_;
+  int32_t max;
+  return base::CheckAdd(offset, size).AssignIfValid(&max) && max <= size_;
 }
 
 void Buffer::SetRange(GLintptr offset, GLsizeiptr size, const GLvoid * data) {
@@ -307,12 +305,10 @@ bool Buffer::GetMaxValueForRange(
   }
 
   uint32_t size;
-  if (!SafeMultiplyUint32(
-      count, GLES2Util::GetGLTypeSizeForBuffers(type), &size)) {
-    return false;
-  }
-
-  if (!SafeAddUint32(offset, size, &size)) {
+  if (!base::CheckAdd(
+           offset,
+           base::CheckMul(count, GLES2Util::GetGLTypeSizeForBuffers(type)))
+           .AssignIfValid(&size)) {
     return false;
   }
 
@@ -897,10 +893,10 @@ bool BufferManager::RequestBuffersAccess(
       return false;
     }
     GLsizeiptr size = bindings->GetEffectiveBufferSize(ii);
-    base::CheckedNumeric<GLsizeiptr> required_size = variable_sizes[ii];
-    required_size *= count;
-    if (size < required_size.ValueOrDefault(
-            std::numeric_limits<GLsizeiptr>::max())) {
+    GLsizeiptr required_size;
+    if (!base::CheckMul(variable_sizes[ii], count)
+             .AssignIfValid(&required_size) ||
+        size < required_size) {
       std::string msg = base::StringPrintf(
           "%s : buffer or buffer range at index %zu not large enough",
           message_tag, ii);
diff --git a/chromium/gpu/command_buffer/service/gles2_cmd_decoder.cc b/chromium/gpu/command_buffer/service/gles2_cmd_decoder.cc
index dbc3883da46..fa4cb3eb118 100644
--- a/chromium/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/chromium/gpu/command_buffer/service/gles2_cmd_decoder.cc
@@ -4355,7 +4355,8 @@ bool GLES2DecoderImpl::GenTransformFeedbacksHelper(
 bool GLES2DecoderImpl::GenPathsCHROMIUMHelper(GLuint first_client_id,
                                               GLsizei range) {
   GLuint last_client_id;
-  if (!SafeAddUint32(first_client_id, range - 1, &last_client_id))
+  if (range < 1 || !base::CheckAdd(first_client_id, range - 1)
+                        .AssignIfValid(&last_client_id))
     return false;
 
   if (path_manager()->HasPathsInRange(first_client_id, last_client_id))
@@ -4381,7 +4382,8 @@ bool GLES2DecoderImpl::GenPathsCHROMIUMHelper(GLuint first_client_id,
 bool GLES2DecoderImpl::DeletePathsCHROMIUMHelper(GLuint first_client_id,
                                                  GLsizei range) {
   GLuint last_client_id;
-  if (!SafeAddUint32(first_client_id, range - 1, &last_client_id))
+  if (range < 1 || !base::CheckAdd(first_client_id, range - 1)
+                        .AssignIfValid(&last_client_id))
     return false;
 
   path_manager()->RemovePaths(first_client_id, last_client_id);
@@ -10358,7 +10360,8 @@ bool GLES2DecoderImpl::SimulateAttrib0(
   uint32_t size_needed = 0;
 
   if (num_vertices == 0 ||
-      !SafeMultiplyUint32(num_vertices, sizeof(Vec4f), &size_needed) ||
+      !base::CheckMul(num_vertices, sizeof(Vec4f))
+           .AssignIfValid(&size_needed) ||
       size_needed > 0x7FFFFFFFU) {
     LOCAL_SET_GL_ERROR(GL_OUT_OF_MEMORY, function_name, "Simulating attrib 0");
     return false;
@@ -10475,7 +10478,7 @@ bool GLES2DecoderImpl::SimulateFixedAttribs(
   // to be used normally. It's just here to pass that OpenGL ES 2.0 conformance
   // tests so we just add to the buffer attrib used.
 
-  GLuint elements_needed = 0;
+  base::CheckedNumeric<uint32_t> elements_needed = 0;
   const VertexAttribManager::VertexAttribList& enabled_attribs =
       state_.vertex_attrib_manager->GetEnabledVertexAttribs();
   for (VertexAttribManager::VertexAttribList::const_iterator it =
@@ -10494,19 +10497,14 @@ bool GLES2DecoderImpl::SimulateFixedAttribs(
     if (attrib_info &&
         attrib->CanAccess(max_accessed) &&
         attrib->type() == GL_FIXED) {
-      uint32_t elements_used = 0;
-      if (!SafeMultiplyUint32(num_vertices, attrib->size(), &elements_used) ||
-          !SafeAddUint32(elements_needed, elements_used, &elements_needed)) {
-        LOCAL_SET_GL_ERROR(
-            GL_OUT_OF_MEMORY, function_name, "simulating GL_FIXED attribs");
-        return false;
-      }
+      elements_needed += base::CheckMul(num_vertices, attrib->size());
     }
   }
 
   const uint32_t kSizeOfFloat = sizeof(float);  // NOLINT
   uint32_t size_needed = 0;
-  if (!SafeMultiplyUint32(elements_needed, kSizeOfFloat, &size_needed) ||
+  if (!base::CheckMul(elements_needed, kSizeOfFloat)
+           .AssignIfValid(&size_needed) ||
       size_needed > 0x7FFFFFFFU) {
     LOCAL_SET_GL_ERROR(
         GL_OUT_OF_MEMORY, function_name, "simulating GL_FIXED attribs");
@@ -11972,7 +11970,8 @@ error::Error GLES2DecoderImpl::HandleReadPixels(uint32_t immediate_data_size,
       return error::kNoError;
     }
     uint32_t size = 0;
-    if (!SafeAddUint32(pixels_size + skip_size, pixels_shm_offset, &size)) {
+    if (!base::CheckAdd(pixels_size + skip_size, pixels_shm_offset)
+             .AssignIfValid(&size)) {
       LOCAL_SET_GL_ERROR(GL_INVALID_VALUE, func_name, "size + offset overflow");
       return error::kNoError;
     }
@@ -12117,7 +12116,8 @@ error::Error GLES2DecoderImpl::HandleReadPixels(uint32_t immediate_data_size,
 
   int32_t max_x;
   int32_t max_y;
-  if (!SafeAddInt32(x, width, &max_x) || !SafeAddInt32(y, height, &max_y)) {
+  if (!base::CheckAdd(x, width).AssignIfValid(&max_x) ||
+      !base::CheckAdd(y, height).AssignIfValid(&max_y)) {
     LOCAL_SET_GL_ERROR(GL_INVALID_VALUE, func_name, "dimensions out of range");
     return error::kNoError;
   }
@@ -13329,7 +13329,8 @@ bool GLES2DecoderImpl::ClearLevel3D(Texture* texture,
     subs.push_back(TexSubCoord3D(0, 0, 0, width, height, depth));
   } else {
     uint32_t size_per_layer;
-    if (!SafeMultiplyUint32(padded_row_size, height, &size_per_layer)) {
+    if (!base::CheckMul(padded_row_size, height)
+             .AssignIfValid(&size_per_layer)) {
       return false;
     }
     if (size_per_layer < kMaxZeroSize) {
@@ -14285,7 +14286,7 @@ error::Error GLES2DecoderImpl::HandleTexImage2D(uint32_t immediate_data_size,
   // For testing only. Allows us to stress the ability to respond to OOM errors.
   uint32_t num_pixels;
   if (workarounds().simulate_out_of_memory_on_large_textures &&
-      (!SafeMultiplyUint32(width, height, &num_pixels) ||
+      (!base::CheckMul(width, height).AssignIfValid(&num_pixels) ||
        (num_pixels >= 4096 * 4096))) {
     LOCAL_SET_GL_ERROR(GL_OUT_OF_MEMORY, func_name, "synthetic out of memory");
     return error::kNoError;
@@ -14382,7 +14383,7 @@ error::Error GLES2DecoderImpl::HandleTexImage3D(uint32_t immediate_data_size,
   // For testing only. Allows us to stress the ability to respond to OOM errors.
   uint32_t num_pixels;
   if (workarounds().simulate_out_of_memory_on_large_textures &&
-      (!SafeMultiplyUint32(width, height, &num_pixels) ||
+      (!base::CheckMul(width, height).AssignIfValid(&num_pixels) ||
        (num_pixels >= 4096 * 4096))) {
     LOCAL_SET_GL_ERROR(GL_OUT_OF_MEMORY, func_name, "synthetic out of memory");
     return error::kNoError;
@@ -15839,7 +15840,7 @@ error::Error GLES2DecoderImpl::HandleShaderBinary(
     return error::kNoError;
   }
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(%data_size)) {
     return error::kOutOfBounds;
   }
   const GLuint* shaders = GetSharedMemoryAs<const GLuint*>(
@@ -17324,8 +17325,9 @@ void GLES2DecoderImpl::CopySubTextureHelper(const char* function_name,
     // See: https://crbug.com/586476
     int32_t max_x;
     int32_t max_y;
-    if (!SafeAddInt32(x, width, &max_x) || !SafeAddInt32(y, height, &max_y) ||
-        x < 0 || y < 0 || max_x > source_width || max_y > source_height) {
+    if (!base::CheckAdd(x, width).AssignIfValid(&max_x) ||
+        !base::CheckAdd(y, height).AssignIfValid(&max_y) || x < 0 || y < 0 ||
+        max_x > source_width || max_y > source_height) {
       LOCAL_SET_GL_ERROR(GL_INVALID_VALUE, function_name,
                          "source texture bad dimensions");
       return;
@@ -19010,7 +19012,8 @@ class PathCommandValidatorContext {
     DCHECK_LE(transforms_component_count, 12U);
     uint32_t one_transform_size = sizeof(GLfloat) * transforms_component_count;
     uint32_t transforms_size = 0;
-    if (!SafeMultiplyUint32(one_transform_size, num_paths, &transforms_size)) {
+    if (!base::CheckMul(one_transform_size, num_paths)
+             .AssignIfValid(&transforms_size)) {
       error_ = error::kOutOfBounds;
       return false;
     }
@@ -19045,7 +19048,7 @@ class PathCommandValidatorContext {
                            uint32_t shm_offset,
                            std::unique_ptr<GLuint[]>* out_buffer) {
     uint32_t paths_size = 0;
-    if (!SafeMultiplyUint32(num_paths, sizeof(T), &paths_size)) {
+    if (!base::CheckMul(num_paths, sizeof(T)).AssignIfValid(&paths_size)) {
       error_ = error::kOutOfBounds;
       return false;
     }
@@ -19225,7 +19228,8 @@ error::Error GLES2DecoderImpl::HandlePathCommandsCHROMIUM(
     uint32_t coords_size = 0;
     uint32_t coord_type_size =
         GLES2Util::GetGLTypeSizeForPathCoordType(coord_type);
-    if (!SafeMultiplyUint32(num_coords, coord_type_size, &coords_size))
+    if (!base::CheckMul(num_coords, coord_type_size)
+             .AssignIfValid(&coords_size))
       return error::kOutOfBounds;
 
     uint32_t coords_shm_id = static_cast<uint32_t>(c.coords_shm_id);
diff --git a/chromium/gpu/command_buffer/service/gles2_cmd_decoder_autogen.h b/chromium/gpu/command_buffer/service/gles2_cmd_decoder_autogen.h
index b5c7c24da3f..47b0044016a 100644
--- a/chromium/gpu/command_buffer/service/gles2_cmd_decoder_autogen.h
+++ b/chromium/gpu/command_buffer/service/gles2_cmd_decoder_autogen.h
@@ -739,7 +739,7 @@ error::Error GLES2DecoderImpl::HandleDeleteBuffersImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* buffers = GetImmediateDataAs<volatile const GLuint*>(
@@ -759,7 +759,7 @@ error::Error GLES2DecoderImpl::HandleDeleteFramebuffersImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* framebuffers =
@@ -780,7 +780,7 @@ error::Error GLES2DecoderImpl::HandleDeleteRenderbuffersImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* renderbuffers =
@@ -803,7 +803,7 @@ error::Error GLES2DecoderImpl::HandleDeleteSamplersImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* samplers = GetImmediateDataAs<volatile const GLuint*>(
@@ -834,7 +834,7 @@ error::Error GLES2DecoderImpl::HandleDeleteTexturesImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* textures = GetImmediateDataAs<volatile const GLuint*>(
@@ -857,7 +857,7 @@ error::Error GLES2DecoderImpl::HandleDeleteTransformFeedbacksImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* ids = GetImmediateDataAs<volatile const GLuint*>(
@@ -1111,7 +1111,7 @@ error::Error GLES2DecoderImpl::HandleGenBuffersImmediate(
       *static_cast<const volatile gles2::cmds::GenBuffersImmediate*>(cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* buffers =
@@ -1151,7 +1151,7 @@ error::Error GLES2DecoderImpl::HandleGenFramebuffersImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* framebuffers =
@@ -1177,7 +1177,7 @@ error::Error GLES2DecoderImpl::HandleGenRenderbuffersImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* renderbuffers =
@@ -1204,7 +1204,7 @@ error::Error GLES2DecoderImpl::HandleGenSamplersImmediate(
       *static_cast<const volatile gles2::cmds::GenSamplersImmediate*>(cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* samplers =
@@ -1229,7 +1229,7 @@ error::Error GLES2DecoderImpl::HandleGenTexturesImmediate(
       *static_cast<const volatile gles2::cmds::GenTexturesImmediate*>(cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* textures =
@@ -1257,7 +1257,7 @@ error::Error GLES2DecoderImpl::HandleGenTransformFeedbacksImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* ids =
@@ -4317,7 +4317,7 @@ error::Error GLES2DecoderImpl::HandleGenQueriesEXTImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* queries =
@@ -4343,7 +4343,7 @@ error::Error GLES2DecoderImpl::HandleDeleteQueriesEXTImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* queries = GetImmediateDataAs<volatile const GLuint*>(
@@ -4435,7 +4435,7 @@ error::Error GLES2DecoderImpl::HandleGenVertexArraysOESImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* arrays =
@@ -4461,7 +4461,7 @@ error::Error GLES2DecoderImpl::HandleDeleteVertexArraysOESImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* arrays = GetImmediateDataAs<volatile const GLuint*>(
diff --git a/chromium/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc b/chromium/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc
index b694ab930e9..ee526ebe27e 100644
--- a/chromium/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc
+++ b/chromium/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc
@@ -945,7 +945,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleShaderBinary(
   uint32_t binary_shm_offset = c.binary_shm_offset;
 
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   const GLuint* shaders = GetSharedMemoryAs<const GLuint*>(
diff --git a/chromium/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers_autogen.cc b/chromium/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers_autogen.cc
index 863be0bc6de..8c902e70e74 100644
--- a/chromium/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers_autogen.cc
+++ b/chromium/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers_autogen.cc
@@ -573,7 +573,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleDeleteBuffersImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* buffers = GetImmediateDataAs<volatile const GLuint*>(
@@ -596,7 +596,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleDeleteFramebuffersImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* framebuffers =
@@ -633,7 +633,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleDeleteRenderbuffersImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* renderbuffers =
@@ -659,7 +659,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleDeleteSamplersImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* samplers = GetImmediateDataAs<volatile const GLuint*>(
@@ -710,7 +710,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleDeleteTexturesImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* textures = GetImmediateDataAs<volatile const GLuint*>(
@@ -737,7 +737,7 @@ GLES2DecoderPassthroughImpl::HandleDeleteTransformFeedbacksImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* ids = GetImmediateDataAs<volatile const GLuint*>(
@@ -957,7 +957,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGenBuffersImmediate(
       *static_cast<const volatile gles2::cmds::GenBuffersImmediate*>(cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* buffers =
@@ -993,7 +993,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGenFramebuffersImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* framebuffers =
@@ -1016,7 +1016,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGenRenderbuffersImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* renderbuffers =
@@ -1040,7 +1040,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGenSamplersImmediate(
       *static_cast<const volatile gles2::cmds::GenSamplersImmediate*>(cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* samplers =
@@ -1062,7 +1062,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGenTexturesImmediate(
       *static_cast<const volatile gles2::cmds::GenTexturesImmediate*>(cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* textures =
@@ -1087,7 +1087,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGenTransformFeedbacksImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* ids =
@@ -3751,7 +3751,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGenQueriesEXTImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* queries =
@@ -3774,7 +3774,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleDeleteQueriesEXTImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* queries = GetImmediateDataAs<volatile const GLuint*>(
@@ -3835,7 +3835,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleGenVertexArraysOESImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* arrays =
@@ -3858,7 +3858,7 @@ error::Error GLES2DecoderPassthroughImpl::HandleDeleteVertexArraysOESImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* arrays = GetImmediateDataAs<volatile const GLuint*>(
diff --git a/chromium/gpu/command_buffer/service/raster_decoder.cc b/chromium/gpu/command_buffer/service/raster_decoder.cc
index 24ad0fc683d..4080899df2b 100644
--- a/chromium/gpu/command_buffer/service/raster_decoder.cc
+++ b/chromium/gpu/command_buffer/service/raster_decoder.cc
@@ -2695,8 +2695,8 @@ void RasterDecoderImpl::DoCopySubTexture(GLuint source_id,
     // See: https://crbug.com/586476
     int32_t max_x;
     int32_t max_y;
-    if (!gles2::SafeAddInt32(x, width, &max_x) ||
-        !gles2::SafeAddInt32(y, height, &max_y) || x < 0 || y < 0 ||
+    if (!base::CheckAdd(x, width).AssignIfValid(&max_x) ||
+        !base::CheckAdd(y, height).AssignIfValid(&max_y) || x < 0 || y < 0 ||
         max_x > source_width || max_y > source_height) {
       LOCAL_SET_GL_ERROR(GL_INVALID_VALUE, "glCopySubTexture",
                          "source texture bad dimensions");
diff --git a/chromium/gpu/command_buffer/service/raster_decoder_autogen.h b/chromium/gpu/command_buffer/service/raster_decoder_autogen.h
index d239d6578db..af80c4cf792 100644
--- a/chromium/gpu/command_buffer/service/raster_decoder_autogen.h
+++ b/chromium/gpu/command_buffer/service/raster_decoder_autogen.h
@@ -20,7 +20,7 @@ error::Error RasterDecoderImpl::HandleDeleteTexturesImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!gles2::SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* textures =
@@ -102,7 +102,7 @@ error::Error RasterDecoderImpl::HandleGenQueriesEXTImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!gles2::SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile GLuint* queries = gles2::GetImmediateDataAs<volatile GLuint*>(
@@ -128,7 +128,7 @@ error::Error RasterDecoderImpl::HandleDeleteQueriesEXTImmediate(
           cmd_data);
   GLsizei n = static_cast<GLsizei>(c.n);
   uint32_t data_size;
-  if (!gles2::SafeMultiplyUint32(n, sizeof(GLuint), &data_size)) {
+  if (!base::CheckMul(n, sizeof(GLuint)).AssignIfValid(&data_size)) {
     return error::kOutOfBounds;
   }
   volatile const GLuint* queries =
diff --git a/chromium/gpu/command_buffer/service/renderbuffer_manager.cc b/chromium/gpu/command_buffer/service/renderbuffer_manager.cc
index 722330a3ee2..edfc0694e0a 100644
--- a/chromium/gpu/command_buffer/service/renderbuffer_manager.cc
+++ b/chromium/gpu/command_buffer/service/renderbuffer_manager.cc
@@ -292,20 +292,13 @@ bool RenderbufferManager::ComputeEstimatedRenderbufferSize(
     uint32_t* size) const {
   DCHECK(size);
 
-  uint32_t temp = 0;
-  if (!SafeMultiplyUint32(width, height, &temp)) {
-    return false;
-  }
-  if (!SafeMultiplyUint32(temp, (samples == 0 ? 1 : samples), &temp)) {
-    return false;
-  }
   GLenum impl_format = InternalRenderbufferFormatToImplFormat(internal_format);
-  if (!SafeMultiplyUint32(
-      temp, GLES2Util::RenderbufferBytesPerPixel(impl_format), &temp)) {
-    return false;
-  }
-  *size = temp;
-  return true;
+  uint32_t bytes_per_pixel = GLES2Util::RenderbufferBytesPerPixel(impl_format);
+  base::CheckedNumeric<uint32_t> checked_size = width;
+  checked_size *= height;
+  checked_size *= (samples == 0 ? 1 : samples);
+  checked_size *= bytes_per_pixel;
+  return checked_size.AssignIfValid(size);
 }
 
 GLenum RenderbufferManager::InternalRenderbufferFormatToImplFormat(
diff --git a/chromium/gpu/command_buffer/service/texture_manager.cc b/chromium/gpu/command_buffer/service/texture_manager.cc
index d697bda2cbb..cd0576a974b 100644
--- a/chromium/gpu/command_buffer/service/texture_manager.cc
+++ b/chromium/gpu/command_buffer/service/texture_manager.cc
@@ -1256,18 +1256,12 @@ bool Texture::ValidForTexture(
     int32_t max_x;
     int32_t max_y;
     int32_t max_z;
-    return xoffset >= 0 &&
-           yoffset >= 0 &&
-           zoffset >= 0 &&
-           width >= 0 &&
-           height >= 0 &&
-           depth >= 0 &&
-           SafeAddInt32(xoffset, width, &max_x) &&
-           SafeAddInt32(yoffset, height, &max_y) &&
-           SafeAddInt32(zoffset, depth, &max_z) &&
-           max_x <= info.width &&
-           max_y <= info.height &&
-           max_z <= info.depth;
+    return xoffset >= 0 && yoffset >= 0 && zoffset >= 0 && width >= 0 &&
+           height >= 0 && depth >= 0 &&
+           base::CheckAdd(xoffset, width).AssignIfValid(&max_x) &&
+           base::CheckAdd(yoffset, height).AssignIfValid(&max_y) &&
+           base::CheckAdd(zoffset, depth).AssignIfValid(&max_z) &&
+           max_x <= info.width && max_y <= info.height && max_z <= info.depth;
   }
   return false;
 }