[Backport] Security bug 905509 (4/13)

Backport of original patch by Antoine Labour <piman@chromium.org>:
Use uint32_t instead of size_t in gpu::gles2::GLES2Util

Fix up callers and add math validation as necessary.

Bug: 905509
Change-Id: Icf9e7baf5fdaf6c493577a263ace4cbe940fb4d2
Reviewed-on: https://chromium-review.googlesource.com/c/1399570
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

7 files changed, 101 insertions, 87 deletions

diff --git a/chromium/gpu/command_buffer/build_cmd_buffer_lib.py b/chromium/gpu/command_buffer/build_cmd_buffer_lib.py
index de34de3c5f4..72602b2d01e 100644
--- a/chromium/gpu/command_buffer/build_cmd_buffer_lib.py
+++ b/chromium/gpu/command_buffer/build_cmd_buffer_lib.py
@@ -3345,7 +3345,7 @@ TEST_P(%(test_name)s, %(name)sInvalidArgs%(arg_index)d_%(value_index)d) {
     self.WriteClientGLCallLog(func, f)
 
     if self.__NeedsToCalcDataCount(func):
-      f.write("  size_t count = %sGLES2Util::Calc%sDataCount(%s);\n" %
+      f.write("  uint32_t count = %sGLES2Util::Calc%sDataCount(%s);\n" %
                  (_Namespace(), func.name, func.GetOriginalArgs()[0].name))
       f.write("  DCHECK_LE(count, %du);\n" % self.GetArrayCount(func))
       f.write("  if (count == 0) {\n")
@@ -3355,8 +3355,8 @@ TEST_P(%(test_name)s, %(name)sInvalidArgs%(arg_index)d_%(value_index)d) {
       f.write("    return;\n")
       f.write("  }\n")
     else:
-      f.write("  size_t count = %d;" % self.GetArrayCount(func))
-    f.write("  for (size_t ii = 0; ii < count; ++ii)\n")
+      f.write("  uint32_t count = %d;" % self.GetArrayCount(func))
+    f.write("  for (uint32_t ii = 0; ii < count; ++ii)\n")
     f.write('    GPU_CLIENT_LOG("value[" << ii << "]: " << %s[ii]);\n' %
                func.GetLastOriginalArg().name)
     for arg in func.GetOriginalArgs():
diff --git a/chromium/gpu/command_buffer/client/gles2_implementation_impl_autogen.h b/chromium/gpu/command_buffer/client/gles2_implementation_impl_autogen.h
index 949b955ebab..e6be5efbbfa 100644
--- a/chromium/gpu/command_buffer/client/gles2_implementation_impl_autogen.h
+++ b/chromium/gpu/command_buffer/client/gles2_implementation_impl_autogen.h
@@ -242,13 +242,13 @@ void GLES2Implementation::ClearBufferfv(GLenum buffer,
                      << GLES2Util::GetStringBufferfv(buffer) << ", "
                      << drawbuffers << ", " << static_cast<const void*>(value)
                      << ")");
-  size_t count = GLES2Util::CalcClearBufferfvDataCount(buffer);
+  uint32_t count = GLES2Util::CalcClearBufferfvDataCount(buffer);
   DCHECK_LE(count, 4u);
   if (count == 0) {
     SetGLErrorInvalidEnum("glClearBufferfv", buffer, "buffer");
     return;
   }
-  for (size_t ii = 0; ii < count; ++ii)
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << value[ii]);
   helper_->ClearBufferfvImmediate(buffer, drawbuffers, value);
   CheckGLError();
@@ -262,13 +262,13 @@ void GLES2Implementation::ClearBufferiv(GLenum buffer,
                      << GLES2Util::GetStringBufferiv(buffer) << ", "
                      << drawbuffers << ", " << static_cast<const void*>(value)
                      << ")");
-  size_t count = GLES2Util::CalcClearBufferivDataCount(buffer);
+  uint32_t count = GLES2Util::CalcClearBufferivDataCount(buffer);
   DCHECK_LE(count, 4u);
   if (count == 0) {
     SetGLErrorInvalidEnum("glClearBufferiv", buffer, "buffer");
     return;
   }
-  for (size_t ii = 0; ii < count; ++ii)
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << value[ii]);
   helper_->ClearBufferivImmediate(buffer, drawbuffers, value);
   CheckGLError();
@@ -282,13 +282,13 @@ void GLES2Implementation::ClearBufferuiv(GLenum buffer,
                      << GLES2Util::GetStringBufferuiv(buffer) << ", "
                      << drawbuffers << ", " << static_cast<const void*>(value)
                      << ")");
-  size_t count = GLES2Util::CalcClearBufferuivDataCount(buffer);
+  uint32_t count = GLES2Util::CalcClearBufferuivDataCount(buffer);
   DCHECK_LE(count, 4u);
   if (count == 0) {
     SetGLErrorInvalidEnum("glClearBufferuiv", buffer, "buffer");
     return;
   }
-  for (size_t ii = 0; ii < count; ++ii)
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << value[ii]);
   helper_->ClearBufferuivImmediate(buffer, drawbuffers, value);
   CheckGLError();
@@ -1763,8 +1763,8 @@ void GLES2Implementation::SamplerParameterfv(GLuint sampler,
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glSamplerParameterfv(" << sampler
                      << ", " << GLES2Util::GetStringSamplerParameter(pname)
                      << ", " << static_cast<const void*>(params) << ")");
-  size_t count = 1;
-  for (size_t ii = 0; ii < count; ++ii)
+  uint32_t count = 1;
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << params[ii]);
   helper_->SamplerParameterfvImmediate(sampler, pname, params);
   CheckGLError();
@@ -1788,8 +1788,8 @@ void GLES2Implementation::SamplerParameteriv(GLuint sampler,
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glSamplerParameteriv(" << sampler
                      << ", " << GLES2Util::GetStringSamplerParameter(pname)
                      << ", " << static_cast<const void*>(params) << ")");
-  size_t count = 1;
-  for (size_t ii = 0; ii < count; ++ii)
+  uint32_t count = 1;
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << params[ii]);
   helper_->SamplerParameterivImmediate(sampler, pname, params);
   CheckGLError();
@@ -1931,8 +1931,8 @@ void GLES2Implementation::TexParameterfv(GLenum target,
                      << GLES2Util::GetStringTextureBindTarget(target) << ", "
                      << GLES2Util::GetStringTextureParameter(pname) << ", "
                      << static_cast<const void*>(params) << ")");
-  size_t count = 1;
-  for (size_t ii = 0; ii < count; ++ii)
+  uint32_t count = 1;
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << params[ii]);
   helper_->TexParameterfvImmediate(target, pname, params);
   CheckGLError();
@@ -1958,8 +1958,8 @@ void GLES2Implementation::TexParameteriv(GLenum target,
                      << GLES2Util::GetStringTextureBindTarget(target) << ", "
                      << GLES2Util::GetStringTextureParameter(pname) << ", "
                      << static_cast<const void*>(params) << ")");
-  size_t count = 1;
-  for (size_t ii = 0; ii < count; ++ii)
+  uint32_t count = 1;
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << params[ii]);
   helper_->TexParameterivImmediate(target, pname, params);
   CheckGLError();
@@ -2649,8 +2649,8 @@ void GLES2Implementation::VertexAttrib1fv(GLuint indx, const GLfloat* values) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glVertexAttrib1fv(" << indx << ", "
                      << static_cast<const void*>(values) << ")");
-  size_t count = 1;
-  for (size_t ii = 0; ii < count; ++ii)
+  uint32_t count = 1;
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << values[ii]);
   helper_->VertexAttrib1fvImmediate(indx, values);
   CheckGLError();
@@ -2668,8 +2668,8 @@ void GLES2Implementation::VertexAttrib2fv(GLuint indx, const GLfloat* values) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glVertexAttrib2fv(" << indx << ", "
                      << static_cast<const void*>(values) << ")");
-  size_t count = 2;
-  for (size_t ii = 0; ii < count; ++ii)
+  uint32_t count = 2;
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << values[ii]);
   helper_->VertexAttrib2fvImmediate(indx, values);
   CheckGLError();
@@ -2690,8 +2690,8 @@ void GLES2Implementation::VertexAttrib3fv(GLuint indx, const GLfloat* values) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glVertexAttrib3fv(" << indx << ", "
                      << static_cast<const void*>(values) << ")");
-  size_t count = 3;
-  for (size_t ii = 0; ii < count; ++ii)
+  uint32_t count = 3;
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << values[ii]);
   helper_->VertexAttrib3fvImmediate(indx, values);
   CheckGLError();
@@ -2713,8 +2713,8 @@ void GLES2Implementation::VertexAttrib4fv(GLuint indx, const GLfloat* values) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glVertexAttrib4fv(" << indx << ", "
                      << static_cast<const void*>(values) << ")");
-  size_t count = 4;
-  for (size_t ii = 0; ii < count; ++ii)
+  uint32_t count = 4;
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << values[ii]);
   helper_->VertexAttrib4fvImmediate(indx, values);
   CheckGLError();
@@ -2736,8 +2736,8 @@ void GLES2Implementation::VertexAttribI4iv(GLuint indx, const GLint* values) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glVertexAttribI4iv(" << indx
                      << ", " << static_cast<const void*>(values) << ")");
-  size_t count = 4;
-  for (size_t ii = 0; ii < count; ++ii)
+  uint32_t count = 4;
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << values[ii]);
   helper_->VertexAttribI4ivImmediate(indx, values);
   CheckGLError();
@@ -2760,8 +2760,8 @@ void GLES2Implementation::VertexAttribI4uiv(GLuint indx, const GLuint* values) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glVertexAttribI4uiv(" << indx
                      << ", " << static_cast<const void*>(values) << ")");
-  size_t count = 4;
-  for (size_t ii = 0; ii < count; ++ii)
+  uint32_t count = 4;
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << values[ii]);
   helper_->VertexAttribI4uivImmediate(indx, values);
   CheckGLError();
@@ -3350,8 +3350,8 @@ void GLES2Implementation::MatrixLoadfCHROMIUM(GLenum matrixMode,
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glMatrixLoadfCHROMIUM("
                      << GLES2Util::GetStringMatrixMode(matrixMode) << ", "
                      << static_cast<const void*>(m) << ")");
-  size_t count = 16;
-  for (size_t ii = 0; ii < count; ++ii)
+  uint32_t count = 16;
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << m[ii]);
   helper_->MatrixLoadfCHROMIUMImmediate(matrixMode, m);
   CheckGLError();
@@ -3518,8 +3518,8 @@ void GLES2Implementation::UniformMatrix4fvStreamTextureMatrixCHROMIUM(
                      << "] glUniformMatrix4fvStreamTextureMatrixCHROMIUM("
                      << location << ", " << GLES2Util::GetStringBool(transpose)
                      << ", " << static_cast<const void*>(transform) << ")");
-  size_t count = 16;
-  for (size_t ii = 0; ii < count; ++ii)
+  uint32_t count = 16;
+  for (uint32_t ii = 0; ii < count; ++ii)
     GPU_CLIENT_LOG("value[" << ii << "]: " << transform[ii]);
   helper_->UniformMatrix4fvStreamTextureMatrixCHROMIUMImmediate(
       location, transpose, transform);
diff --git a/chromium/gpu/command_buffer/client/vertex_array_object_manager.cc b/chromium/gpu/command_buffer/client/vertex_array_object_manager.cc
index 453de8cde75..c5ef41d98fb 100644
--- a/chromium/gpu/command_buffer/client/vertex_array_object_manager.cc
+++ b/chromium/gpu/command_buffer/client/vertex_array_object_manager.cc
@@ -15,7 +15,8 @@
 namespace gpu {
 namespace gles2 {
 
-static GLsizei RoundUpToMultipleOf4(GLsizei size) {
+template <typename T>
+static T RoundUpToMultipleOf4(T size) {
   return (size + 3) & ~3;
 }
 
@@ -510,20 +511,26 @@ bool VertexArrayObjectManager::SetupSimulatedClientSideBuffers(
     return false;
   }
   *simulated = true;
-  GLsizei total_size = 0;
+  base::CheckedNumeric<GLsizei> checked_total_size = 0;
   // Compute the size of the buffer we need.
   const VertexArrayObject::VertexAttribs& vertex_attribs =
       bound_vertex_array_object_->vertex_attribs();
   for (GLuint ii = 0; ii < vertex_attribs.size(); ++ii) {
     const VertexArrayObject::VertexAttrib& attrib = vertex_attribs[ii];
     if (attrib.IsClientSide() && attrib.enabled()) {
-      size_t bytes_per_element =
+      uint32_t bytes_per_element =
           GLES2Util::GetGroupSizeForBufferType(attrib.size(), attrib.type());
       GLsizei elements = (primcount && attrib.divisor() > 0) ?
           ((primcount - 1) / attrib.divisor() + 1) : num_elements;
-      total_size += RoundUpToMultipleOf4(bytes_per_element * elements);
+      checked_total_size += RoundUpToMultipleOf4(base::CheckMul(bytes_per_element * elements));
     }
   }
+  GLsizei total_size = 0;
+  if (!checked_total_size.AssignIfValid(&total_size)) {
+    gl->SetGLError(GL_INVALID_OPERATION, function_name,
+                   "size overflow for client side arrays");
+    return false;
+  }
   gl_helper->BindBuffer(GL_ARRAY_BUFFER, array_buffer_id_);
   array_buffer_offset_ = 0;
   if (total_size > array_buffer_size_) {
@@ -533,7 +540,7 @@ bool VertexArrayObjectManager::SetupSimulatedClientSideBuffers(
   for (GLuint ii = 0; ii < vertex_attribs.size(); ++ii) {
     const VertexArrayObject::VertexAttrib& attrib = vertex_attribs[ii];
     if (attrib.IsClientSide() && attrib.enabled()) {
-      size_t bytes_per_element =
+      uint32_t bytes_per_element =
           GLES2Util::GetGroupSizeForBufferType(attrib.size(), attrib.type());
       GLsizei real_stride = attrib.stride() ?
           attrib.stride() : static_cast<GLsizei>(bytes_per_element);
@@ -617,8 +624,14 @@ bool VertexArrayObjectManager::SetupSimulatedIndexAndClientSideBuffers(
         break;
     }
     gl_helper->BindBuffer(GL_ELEMENT_ARRAY_BUFFER, element_array_buffer_id_);
-    GLsizei bytes_per_element = GLES2Util::GetGLTypeSizeForBuffers(type);
-    GLsizei bytes_needed = bytes_per_element * count;
+    uint32_t bytes_per_element = GLES2Util::GetGLTypeSizeForBuffers(type);
+    GLsizei bytes_needed = 0;
+    if (!base::CheckMul(bytes_per_element, count)
+             .AssignIfValid(&bytes_needed)) {
+      gl->SetGLError(GL_INVALID_OPERATION, function_name,
+                     "size overflow for client side index arrays");
+      return false;
+    }
     if (bytes_needed > element_array_buffer_size_) {
       element_array_buffer_size_ = bytes_needed;
       gl->BufferDataHelper(
diff --git a/chromium/gpu/command_buffer/common/gles2_cmd_utils.cc b/chromium/gpu/command_buffer/common/gles2_cmd_utils.cc
index 3f7a38a0df1..1f623eaf070 100644
--- a/chromium/gpu/command_buffer/common/gles2_cmd_utils.cc
+++ b/chromium/gpu/command_buffer/common/gles2_cmd_utils.cc
@@ -493,7 +493,7 @@ int GLES2Util::GLGetNumValuesReturned(int id) const {
 namespace {
 
 // Return the number of bytes per element, based on the element type.
-int BytesPerElement(int type) {
+uint32_t BytesPerElement(int type) {
   switch (type) {
     case GL_FLOAT_32_UNSIGNED_INT_24_8_REV:
       return 8;
@@ -524,7 +524,7 @@ int BytesPerElement(int type) {
 }  // anonymous namespace
 
 // Return the number of elements per group of a specified format.
-int GLES2Util::ElementsPerGroup(int format, int type) {
+uint32_t GLES2Util::ElementsPerGroup(int format, int type) {
   switch (type) {
     case GL_UNSIGNED_SHORT_5_6_5:
     case GL_UNSIGNED_SHORT_4_4_4_4:
@@ -570,10 +570,10 @@ int GLES2Util::ElementsPerGroup(int format, int type) {
 }
 
 uint32_t GLES2Util::ComputeImageGroupSize(int format, int type) {
-  int bytes_per_element = BytesPerElement(type);
-  DCHECK_GE(8, bytes_per_element);
-  int elements_per_group = ElementsPerGroup(format, type);
-  DCHECK_GE(4, elements_per_group);
+  uint32_t bytes_per_element = BytesPerElement(type);
+  DCHECK_GE(8u, bytes_per_element);
+  uint32_t elements_per_group = ElementsPerGroup(format, type);
+  DCHECK_GE(4u, elements_per_group);
   return  bytes_per_element * elements_per_group;
 }
 
@@ -722,7 +722,7 @@ bool GLES2Util::ComputeImageDataSizesES3(
   return true;
 }
 
-size_t GLES2Util::RenderbufferBytesPerPixel(int format) {
+uint32_t GLES2Util::RenderbufferBytesPerPixel(int format) {
   switch (format) {
     case GL_STENCIL_INDEX8:
       return 1;
@@ -875,11 +875,11 @@ uint32_t GLES2Util::GetElementCountForUniformType(int type) {
   }
 }
 
-size_t GLES2Util::GetGLTypeSizeForTextures(uint32_t type) {
-  return static_cast<size_t>(BytesPerElement(type));
+uint32_t GLES2Util::GetGLTypeSizeForTextures(uint32_t type) {
+  return BytesPerElement(type);
 }
 
-size_t GLES2Util::GetGLTypeSizeForBuffers(uint32_t type) {
+uint32_t GLES2Util::GetGLTypeSizeForBuffers(uint32_t type) {
   switch (type) {
     case GL_BYTE:
       return sizeof(GLbyte);  // NOLINT
@@ -908,8 +908,9 @@ size_t GLES2Util::GetGLTypeSizeForBuffers(uint32_t type) {
   }
 }
 
-size_t GLES2Util::GetGroupSizeForBufferType(uint32_t count, uint32_t type) {
-  size_t type_size = GetGLTypeSizeForBuffers(type);
+uint32_t GLES2Util::GetGroupSizeForBufferType(uint32_t count, uint32_t type) {
+  DCHECK_LE(count, 4u);
+  uint32_t type_size = GetGLTypeSizeForBuffers(type);
   // For packed types, group size equals to the type size.
   if (type == GL_INT_2_10_10_10_REV || type == GL_UNSIGNED_INT_2_10_10_10_REV) {
     DCHECK_EQ(4u, count);
@@ -917,7 +918,8 @@ size_t GLES2Util::GetGroupSizeForBufferType(uint32_t count, uint32_t type) {
   }
   return type_size * count;
 }
-size_t GLES2Util::GetComponentCountForGLTransformType(uint32_t type) {
+
+uint32_t GLES2Util::GetComponentCountForGLTransformType(uint32_t type) {
   switch (type) {
     case GL_TRANSLATE_X_CHROMIUM:
     case GL_TRANSLATE_Y_CHROMIUM:
@@ -936,7 +938,8 @@ size_t GLES2Util::GetComponentCountForGLTransformType(uint32_t type) {
       return 0;
   }
 }
-size_t GLES2Util::GetCoefficientCountForGLPathFragmentInputGenMode(
+
+uint32_t GLES2Util::GetCoefficientCountForGLPathFragmentInputGenMode(
     uint32_t gen_mode) {
   switch (gen_mode) {
     case GL_EYE_LINEAR_CHROMIUM:
@@ -951,7 +954,7 @@ size_t GLES2Util::GetCoefficientCountForGLPathFragmentInputGenMode(
   }
 }
 
-size_t GLES2Util::GetGLTypeSizeForPathCoordType(uint32_t type) {
+uint32_t GLES2Util::GetGLTypeSizeForPathCoordType(uint32_t type) {
   switch (type) {
     case GL_BYTE:
       return sizeof(GLbyte);  // NOLINT
@@ -968,7 +971,7 @@ size_t GLES2Util::GetGLTypeSizeForPathCoordType(uint32_t type) {
   }
 }
 
-size_t GLES2Util::GetGLTypeSizeForGLPathNameType(uint32_t type) {
+uint32_t GLES2Util::GetGLTypeSizeForGLPathNameType(uint32_t type) {
   switch (type) {
     case GL_BYTE:
       return sizeof(GLbyte);  // NOLINT
@@ -1605,7 +1608,7 @@ GLSLArrayName::GLSLArrayName(const std::string& name) : element_index_(-1) {
   base_name_ = name.substr(0, open_pos);
 }
 
-size_t GLES2Util::CalcClearBufferivDataCount(int buffer) {
+uint32_t GLES2Util::CalcClearBufferivDataCount(int buffer) {
   switch (buffer) {
     case GL_COLOR:
       return 4;
@@ -1616,7 +1619,7 @@ size_t GLES2Util::CalcClearBufferivDataCount(int buffer) {
   }
 }
 
-size_t GLES2Util::CalcClearBufferfvDataCount(int buffer) {
+uint32_t GLES2Util::CalcClearBufferfvDataCount(int buffer) {
   switch (buffer) {
     case GL_COLOR:
       return 4;
@@ -1627,7 +1630,7 @@ size_t GLES2Util::CalcClearBufferfvDataCount(int buffer) {
   }
 }
 
-size_t GLES2Util::CalcClearBufferuivDataCount(int buffer) {
+uint32_t GLES2Util::CalcClearBufferuivDataCount(int buffer) {
   switch (buffer) {
     case GL_COLOR:
       return 4;
diff --git a/chromium/gpu/command_buffer/common/gles2_cmd_utils.h b/chromium/gpu/command_buffer/common/gles2_cmd_utils.h
index 1c51dcd524e..685223f022c 100644
--- a/chromium/gpu/command_buffer/common/gles2_cmd_utils.h
+++ b/chromium/gpu/command_buffer/common/gles2_cmd_utils.h
@@ -137,7 +137,7 @@ class GLES2_UTILS_EXPORT GLES2Util {
   // function is called. If 0 is returned the id is invalid.
   int GLGetNumValuesReturned(int id) const;
 
-  static int ElementsPerGroup(int format, int type);
+  static uint32_t ElementsPerGroup(int format, int type);
   // Computes the size of a single group of elements from a format and type pair
   static uint32_t ComputeImageGroupSize(int format, int type);
 
@@ -165,7 +165,7 @@ class GLES2_UTILS_EXPORT GLES2Util {
       uint32_t* opt_padded_row_size, uint32_t* opt_skip_size,
       uint32_t* opt_padding);
 
-  static size_t RenderbufferBytesPerPixel(int format);
+  static uint32_t RenderbufferBytesPerPixel(int format);
 
   static uint8_t StencilBitsPerPixel(int format);
 
@@ -176,20 +176,20 @@ class GLES2_UTILS_EXPORT GLES2Util {
   // For example, GL_FLOAT_MAT3 returns 9.
   static uint32_t GetElementCountForUniformType(int type);
 
-  static size_t GetGLTypeSizeForTextures(uint32_t type);
+  static uint32_t GetGLTypeSizeForTextures(uint32_t type);
 
-  static size_t GetGLTypeSizeForBuffers(uint32_t type);
+  static uint32_t GetGLTypeSizeForBuffers(uint32_t type);
 
-  static size_t GetGroupSizeForBufferType(uint32_t count, uint32_t type);
+  static uint32_t GetGroupSizeForBufferType(uint32_t count, uint32_t type);
 
-  static size_t GetGLTypeSizeForPathCoordType(uint32_t type);
+  static uint32_t GetGLTypeSizeForPathCoordType(uint32_t type);
 
   static uint32_t GLErrorToErrorBit(uint32_t gl_error);
 
-  static size_t GetComponentCountForGLTransformType(uint32_t type);
-  static size_t GetGLTypeSizeForGLPathNameType(uint32_t type);
+  static uint32_t GetComponentCountForGLTransformType(uint32_t type);
+  static uint32_t GetGLTypeSizeForGLPathNameType(uint32_t type);
 
-  static size_t GetCoefficientCountForGLPathFragmentInputGenMode(
+  static uint32_t GetCoefficientCountForGLPathFragmentInputGenMode(
       uint32_t gen_mode);
 
   static uint32_t GLErrorBitToGLError(uint32_t error_bit);
@@ -228,9 +228,9 @@ class GLES2_UTILS_EXPORT GLES2Util {
   static std::string GetStringBool(uint32_t value);
   static std::string GetStringError(uint32_t value);
 
-  static size_t CalcClearBufferivDataCount(int buffer);
-  static size_t CalcClearBufferfvDataCount(int buffer);
-  static size_t CalcClearBufferuivDataCount(int buffer);
+  static uint32_t CalcClearBufferivDataCount(int buffer);
+  static uint32_t CalcClearBufferfvDataCount(int buffer);
+  static uint32_t CalcClearBufferuivDataCount(int buffer);
 
   static void MapUint64ToTwoUint32(
       uint64_t v64, uint32_t* v32_0, uint32_t* v32_1);
diff --git a/chromium/gpu/command_buffer/service/gles2_cmd_decoder.cc b/chromium/gpu/command_buffer/service/gles2_cmd_decoder.cc
index 22fe1a213ed..a9ed1e1594c 100644
--- a/chromium/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/chromium/gpu/command_buffer/service/gles2_cmd_decoder.cc
@@ -11646,7 +11646,7 @@ error::Error GLES2DecoderImpl::HandleVertexAttribIPointer(
         GL_INVALID_VALUE, "glVertexAttribIPointer", "offset < 0");
     return error::kNoError;
   }
-  GLsizei type_size = GLES2Util::GetGLTypeSizeForBuffers(type);
+  uint32_t type_size = GLES2Util::GetGLTypeSizeForBuffers(type);
   // type_size must be a power of two to use & as optimized modulo.
   DCHECK(GLES2Util::IsPOT(type_size));
   if (offset & (type_size - 1)) {
@@ -11666,7 +11666,8 @@ error::Error GLES2DecoderImpl::HandleVertexAttribIPointer(
                       SHADER_VARIABLE_INT : SHADER_VARIABLE_UINT;
   state_.vertex_attrib_manager->UpdateAttribBaseTypeAndMask(indx, base_type);
 
-  GLsizei group_size = GLES2Util::GetGroupSizeForBufferType(size, type);
+  uint32_t group_size = GLES2Util::GetGroupSizeForBufferType(size, type);
+  DCHECK_LE(group_size, static_cast<uint32_t>(INT_MAX));
   state_.vertex_attrib_manager
       ->SetAttribInfo(indx,
                       state_.bound_array_buffer.get(),
@@ -11737,7 +11738,7 @@ error::Error GLES2DecoderImpl::HandleVertexAttribPointer(
         GL_INVALID_VALUE, "glVertexAttribPointer", "offset < 0");
     return error::kNoError;
   }
-  GLsizei type_size = GLES2Util::GetGLTypeSizeForBuffers(type);
+  uint32_t type_size = GLES2Util::GetGLTypeSizeForBuffers(type);
   // type_size must be a power of two to use & as optimized modulo.
   DCHECK(GLES2Util::IsPOT(type_size));
   if (offset & (type_size - 1)) {
@@ -11756,7 +11757,8 @@ error::Error GLES2DecoderImpl::HandleVertexAttribPointer(
   state_.vertex_attrib_manager->UpdateAttribBaseTypeAndMask(
       indx, SHADER_VARIABLE_FLOAT);
 
-  GLsizei group_size = GLES2Util::GetGroupSizeForBufferType(size, type);
+  uint32_t group_size = GLES2Util::GetGroupSizeForBufferType(size, type);
+  DCHECK_LE(group_size, static_cast<uint32_t>(INT_MAX));
   state_.vertex_attrib_manager
       ->SetAttribInfo(indx,
                       state_.bound_array_buffer.get(),
diff --git a/chromium/gpu/command_buffer/service/texture_manager.cc b/chromium/gpu/command_buffer/service/texture_manager.cc
index 17d4fb9cd56..d697bda2cbb 100644
--- a/chromium/gpu/command_buffer/service/texture_manager.cc
+++ b/chromium/gpu/command_buffer/service/texture_manager.cc
@@ -753,8 +753,7 @@ void Texture::AddToSignature(
   DCHECK(signature);
   DCHECK_GE(level, 0);
   size_t face_index = GLES2Util::GLTargetToFaceIndex(target);
-  DCHECK_LT(static_cast<size_t>(face_index),
-            face_infos_.size());
+  DCHECK_LT(face_index, face_infos_.size());
   DCHECK_LT(static_cast<size_t>(level),
             face_infos_[face_index].level_infos.size());
 
@@ -974,8 +973,7 @@ void Texture::SetLevelClearedRect(GLenum target,
                                   const gfx::Rect& cleared_rect) {
   DCHECK_GE(level, 0);
   size_t face_index = GLES2Util::GLTargetToFaceIndex(target);
-  DCHECK_LT(static_cast<size_t>(face_index),
-            face_infos_.size());
+  DCHECK_LT(face_index, face_infos_.size());
   DCHECK_LT(static_cast<size_t>(level),
             face_infos_[face_index].level_infos.size());
   Texture::LevelInfo& info =
@@ -1144,8 +1142,7 @@ void Texture::SetLevelInfo(GLenum target,
                            const gfx::Rect& cleared_rect) {
   DCHECK_GE(level, 0);
   size_t face_index = GLES2Util::GLTargetToFaceIndex(target);
-  DCHECK_LT(static_cast<size_t>(face_index),
-            face_infos_.size());
+  DCHECK_LT(face_index, face_infos_.size());
   DCHECK_LT(static_cast<size_t>(level),
             face_infos_[face_index].level_infos.size());
   DCHECK_GE(width, 0);
@@ -1232,8 +1229,7 @@ void Texture::SetStreamTextureServiceId(GLuint service_id) {
 void Texture::MarkLevelAsInternalWorkaround(GLenum target, GLint level) {
   DCHECK_GE(level, 0);
   size_t face_index = GLES2Util::GLTargetToFaceIndex(target);
-  DCHECK_LT(static_cast<size_t>(face_index),
-            face_infos_.size());
+  DCHECK_LT(face_index, face_infos_.size());
   DCHECK_LT(static_cast<size_t>(level),
             face_infos_[face_index].level_infos.size());
   Texture::LevelInfo& info =
@@ -1735,7 +1731,7 @@ void Texture::SetLevelImageInternal(GLenum target,
   DCHECK(!stream_texture_image || stream_texture_image == image);
   DCHECK_GE(level, 0);
   size_t face_index = GLES2Util::GLTargetToFaceIndex(target);
-  DCHECK_LT(static_cast<size_t>(face_index), face_infos_.size());
+  DCHECK_LT(face_index, face_infos_.size());
   DCHECK_LT(static_cast<size_t>(level),
             face_infos_[face_index].level_infos.size());
   Texture::LevelInfo& info = face_infos_[face_index].level_infos[level];
@@ -1770,7 +1766,7 @@ void Texture::SetLevelStreamTextureImage(GLenum target,
 void Texture::SetLevelImageState(GLenum target, GLint level, ImageState state) {
   DCHECK_GE(level, 0);
   size_t face_index = GLES2Util::GLTargetToFaceIndex(target);
-  DCHECK_LT(static_cast<size_t>(face_index), face_infos_.size());
+  DCHECK_LT(face_index, face_infos_.size());
   DCHECK_LT(static_cast<size_t>(level),
             face_infos_[face_index].level_infos.size());
   Texture::LevelInfo& info = face_infos_[face_index].level_infos[level];
@@ -2661,7 +2657,7 @@ bool TextureManager::ValidateTexImage(
           "pixel unpack buffer is not large enough");
       return false;
     }
-    size_t type_size = GLES2Util::GetGLTypeSizeForTextures(args.type);
+    uint32_t type_size = GLES2Util::GetGLTypeSizeForTextures(args.type);
     DCHECK_LT(0u, type_size);
     if (offset % type_size != 0) {
       ERRORSTATE_SET_GL_ERROR(
@@ -2951,7 +2947,7 @@ bool TextureManager::ValidateTexSubImage(ContextState* state,
           "pixel unpack buffer is not large enough");
       return false;
     }
-    size_t type_size = GLES2Util::GetGLTypeSizeForTextures(args.type);
+    uint32_t type_size = GLES2Util::GetGLTypeSizeForTextures(args.type);
     DCHECK_LT(0u, type_size);
     if (offset % type_size != 0) {
       ERRORSTATE_SET_GL_ERROR(