2 files changed, 31 insertions, 2 deletions
diff --git a/gpu/command_buffer/client/gles2_implementation.cc b/gpu/command_buffer/client/gles2_implementation.cc
index 0601f55..0debcd0 100644
--- a/gpu/command_buffer/client/gles2_implementation.cc
+++ b/gpu/command_buffer/client/gles2_implementation.cc
@@ -975,7 +975,8 @@ void GLES2Implementation::TexSubImage2D(
 
   if (padded_row_size <= max_size) {
     // Transfer by rows.
-    GLint max_rows = max_size / padded_row_size;
+    GLint max_rows = max_size / std::max(padded_row_size,
+                                         static_cast<GLsizeiptr>(1));
     while (height) {
       GLint num_rows = std::min(height, max_rows);
       GLsizeiptr part_size = num_rows * padded_row_size;
@@ -1239,7 +1240,8 @@ void GLES2Implementation::ReadPixels(
   if (padded_row_size <= max_size) {
     // Transfer by rows.
     // The max rows we can transfer.
-    GLint max_rows = max_size / padded_row_size;
+    GLint max_rows = max_size / std::max(padded_row_size,
+                                         static_cast<GLsizeiptr>(1));
     while (height) {
       // Compute how many rows to transfer.
       GLint num_rows = std::min(height, max_rows);
diff --git a/gpu/command_buffer/client/gles2_implementation_unittest.cc b/gpu/command_buffer/client/gles2_implementation_unittest.cc
index 5e42d51..414183c 100644
--- a/gpu/command_buffer/client/gles2_implementation_unittest.cc
+++ b/gpu/command_buffer/client/gles2_implementation_unittest.cc
@@ -695,6 +695,33 @@ TEST_F(GLES2ImplementationTest, ReadPixels2Reads) {
   EXPECT_EQ(0, memcmp(&expected, commands_, sizeof(expected)));
 }
 
+TEST_F(GLES2ImplementationTest, ReadPixelsBadFormatType) {
+  struct Cmds {
+    ReadPixels read;
+    cmd::SetToken set_token;
+  };
+  const GLint kBytesPerPixel = 4;
+  const GLint kWidth = 2;
+  const GLint kHeight = 2;
+  const GLenum kFormat = 0;
+  const GLenum kType = 0;
+
+  int32 token = 1;
+  uint32 offset = GLES2Implementation::kStartingOffset;
+  Cmds expected;
+  expected.read.Init(0, 0, kWidth, kHeight / 2, kFormat, kType,
+                     kTransferBufferId, offset,
+                     kTransferBufferId, 0);
+  expected.set_token.Init(token++);
+  scoped_array<int8> buffer(new int8[kWidth * kHeight * kBytesPerPixel]);
+
+  EXPECT_CALL(*command_buffer_, OnFlush(_))
+      .Times(1)
+      .RetiresOnSaturation();
+
+  gl_->ReadPixels(0, 0, kWidth, kHeight, kFormat, kType, buffer.get());
+}
+
 TEST_F(GLES2ImplementationTest, MapUnmapBufferSubDataCHROMIUM) {
   struct Cmds {
     BufferSubData buf;