- tbb-commits - lists.torproject.org

[tor-browser/esr24] Bug 969226 - Check if there is enough data to read u32 to avoid buffer overflow. r=bgirard, a=abillings
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 5977bbe71d2afc1b836080515fb9503db4a14bfa Author: Jeff Muizelaar <jmuizelaar(a)mozilla.com> Date: Fri Apr 11 10:25:01 2014 -0400 Bug 969226 - Check if there is enough data to read u32 to avoid buffer overflow. r=bgirard, a=abillings --- gfx/qcms/iccread.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/gfx/qcms/iccread.c b/gfx/qcms/iccread.c index 5c72cf3..63bd090 100644 --- a/gfx/qcms/iccread.c +++ b/gfx/qcms/iccread.c @@ -1007,6 +1007,9 @@ qcms_profile* qcms_profile_from_memory(const void *mem, size_t size) source.size = size; source.valid = true; + if (size < 4) + return INVALID_PROFILE; + length = read_u32(src, 0); if (length <= size) { // shrink the area that we can read if appropriate

1 0

[tor-browser/esr24] No bug, Automated HSTS preload list update from host bld-linux64-spot-486 - a=hsts-update
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit cfc4e0103099db4e854f80e2c08e42d012a93a63 Author: ffxbld <none@none> Date: Sat Apr 19 03:13:13 2014 -0700 No bug, Automated HSTS preload list update from host bld-linux64-spot-486 - a=hsts-update --- security/manager/boot/src/nsSTSPreloadList.errors | 13 +++++-------- security/manager/boot/src/nsSTSPreloadList.inc | 13 ++++++++++++- 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/security/manager/boot/src/nsSTSPreloadList.errors b/security/manager/boot/src/nsSTSPreloadList.errors index cfe99ee..4c1a6eb 100644 --- a/security/manager/boot/src/nsSTSPreloadList.errors +++ b/security/manager/boot/src/nsSTSPreloadList.errors @@ -24,7 +24,7 @@ codereview.chromium.org: did not receive HSTS header crate.io: did not receive HSTS header crowdcurity.com: did not receive HSTS header crypto.is: did not receive HSTS header -csawctf.poly.edu: could not connect to host +csawctf.poly.edu: did not receive HSTS header dl.google.com: did not receive HSTS header docs.google.com: did not receive HSTS header donmez.ws: could not connect to host @@ -71,12 +71,6 @@ nexth.net: did not receive HSTS header nexth.us: could not connect to host openshift.redhat.com: did not receive HSTS header ottospora.nl: could not connect to host -passport.yandex.by: did not receive HSTS header -passport.yandex.com: did not receive HSTS header -passport.yandex.com.tr: did not receive HSTS header -passport.yandex.kz: did not receive HSTS header -passport.yandex.ru: did not receive HSTS header -passport.yandex.ua: did not receive HSTS header paypal.com: max-age too low: 14400 payroll.xero.com: max-age too low: 3600 platform.lookout.com: could not connect to host @@ -85,7 +79,6 @@ prodpad.com: did not receive HSTS header profiles.google.com: did not receive HSTS header rapidresearch.me: did not receive HSTS header sah3.net: could not connect to host -sandbox.mydigipass.com: could not connect to host saturngames.co.uk: did not receive HSTS header script.google.com: did not receive HSTS header security.google.com: did not receive HSTS header @@ -102,6 +95,8 @@ spreadsheets.google.com: did not receive HSTS header square.com: did not receive HSTS header ssl.google-analytics.com: did not receive HSTS header ssl.panoramio.com: did not receive HSTS header +stage.wepay.com: max-age too low: 2592000 +static.wepay.com: did not receive HSTS header sunshinepress.org: could not connect to host surfeasy.com: did not receive HSTS header talk.google.com: did not receive HSTS header @@ -110,6 +105,7 @@ translate.googleapis.com: did not receive HSTS header uprotect.it: could not connect to host wallet.google.com: did not receive HSTS header webmail.mayfirst.org: did not receive HSTS header +wepay.com: max-age too low: 2592000 whonix.org: did not receive HSTS header www.cueup.com: did not receive HSTS header www.developer.mydigipass.com: could not connect to host @@ -129,4 +125,5 @@ www.paypal.com: max-age too low: 14400 www.roddis.net: did not receive HSTS header www.sandbox.mydigipass.com: could not connect to host www.surfeasy.com: did not receive HSTS header +www.wepay.com: max-age too low: 2592000 zoo24.de: max-age too low: 2592000 diff --git a/security/manager/boot/src/nsSTSPreloadList.inc b/security/manager/boot/src/nsSTSPreloadList.inc index b547933..e2ecfc3 100644 --- a/security/manager/boot/src/nsSTSPreloadList.inc +++ b/security/manager/boot/src/nsSTSPreloadList.inc @@ -8,7 +8,7 @@ /*****************************************************************************/ #include "mozilla/StandardInteger.h" -const PRTime gPreloadListExpirationTime = INT64_C(1408183539445000); +const PRTime gPreloadListExpirationTime = INT64_C(1408788322005000); class nsSTSPreload { @@ -21,6 +21,7 @@ static const nsSTSPreload kSTSPreloadList[] = { { "accounts.google.com", true }, { "aclu.org", false }, { "activiti.alfresco.com", false }, + { "adsfund.org", true }, { "aladdinschools.appspot.com", false }, { "alpha.irccloud.com", false }, { "api.intercom.io", false }, @@ -44,6 +45,7 @@ static const nsSTSPreload kSTSPreloadList[] = { { "carezone.com", false }, { "check.torproject.org", false }, { "chromiumcodereview.appspot.com", false }, + { "cloudcert.org", true }, { "cloudns.com.au", true }, { "cloudsecurityalliance.org", true }, { "codereview.appspot.com", false }, @@ -137,6 +139,12 @@ static const nsSTSPreload kSTSPreloadList[] = { { "opsmate.com", false }, { "p.linode.com", false }, { "packagist.org", false }, + { "passport.yandex.by", false }, + { "passport.yandex.com", false }, + { "passport.yandex.com.tr", false }, + { "passport.yandex.kz", false }, + { "passport.yandex.ru", false }, + { "passport.yandex.ua", false }, { "passwd.io", true }, { "passwordbox.com", false }, { "paste.linode.com", false }, @@ -149,6 +157,7 @@ static const nsSTSPreload kSTSPreloadList[] = { { "plus.google.com", false }, { "plus.sandbox.google.com", false }, { "publications.qld.gov.au", false }, + { "pult.co", true }, { "pypi.python.org", true }, { "python.org", false }, { "riseup.net", true }, @@ -157,6 +166,7 @@ static const nsSTSPreload kSTSPreloadList[] = { { "roundcube.mayfirst.org", false }, { "sandbox.mydigipass.com", false }, { "securityheaders.com", true }, + { "seifried.org", true }, { "semenkovich.com", true }, { "shodan.io", true }, { "silentcircle.com", false }, @@ -174,6 +184,7 @@ static const nsSTSPreload kSTSPreloadList[] = { { "torproject.org", false }, { "twitter.com", false }, { "ubertt.org", true }, + { "vmoagents.com", false }, { "webmail.gigahost.dk", false }, { "webmail.onlime.ch", false }, { "wiki.python.org", true },

1 0

[tor-browser/esr24] Backed out changeset 32bb91602986 (bug 995995) for mochitest bustage.
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit c5e8d09fd82fce6198b0e89f107377f69832f25e Author: Ryan VanderMeulen <ryanvm(a)gmail.com> Date: Fri Apr 18 11:39:47 2014 -0400 Backed out changeset 32bb91602986 (bug 995995) for mochitest bustage. --- testing/profiles/prefs_general.js | 9 --------- 1 file changed, 9 deletions(-) diff --git a/testing/profiles/prefs_general.js b/testing/profiles/prefs_general.js index 2e5a16f..3032a65 100644 --- a/testing/profiles/prefs_general.js +++ b/testing/profiles/prefs_general.js @@ -141,12 +141,3 @@ user_pref("media.webaudio.legacy.AudioParam", true); user_pref("media.webaudio.legacy.BiquadFilterNode", true); user_pref("media.webaudio.legacy.PannerNode", true); user_pref("media.webaudio.legacy.OscillatorNode", true); - -// Don't connect to Yahoo! for RSS feed tests. -// en-US only uses .types.0.uri, but set all of them just to be sure. -user_pref('browser.contentHandlers.types.0.uri', 'http://test1.example.org/rss?url=%%s') -user_pref('browser.contentHandlers.types.1.uri', 'http://test1.example.org/rss?url=%%s') -user_pref('browser.contentHandlers.types.2.uri', 'http://test1.example.org/rss?url=%%s') -user_pref('browser.contentHandlers.types.3.uri', 'http://test1.example.org/rss?url=%%s') -user_pref('browser.contentHandlers.types.4.uri', 'http://test1.example.org/rss?url=%%s') -user_pref('browser.contentHandlers.types.5.uri', 'http://test1.example.org/rss?url=%%s')

1 0

[tor-browser/esr24] Bug 995995 - Set testing prefs to redirect to the test proxy server for RSS feeds. r=jmaher, a=test-only
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit ff565da2e623662c516976b9a964c3db5fa1bbd2 Author: Nathan Froyd <froydnj(a)mozilla.com> Date: Tue Apr 15 17:14:51 2014 -0400 Bug 995995 - Set testing prefs to redirect to the test proxy server for RSS feeds. r=jmaher, a=test-only --- testing/profiles/prefs_general.js | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/testing/profiles/prefs_general.js b/testing/profiles/prefs_general.js index 3032a65..2e5a16f 100644 --- a/testing/profiles/prefs_general.js +++ b/testing/profiles/prefs_general.js @@ -141,3 +141,12 @@ user_pref("media.webaudio.legacy.AudioParam", true); user_pref("media.webaudio.legacy.BiquadFilterNode", true); user_pref("media.webaudio.legacy.PannerNode", true); user_pref("media.webaudio.legacy.OscillatorNode", true); + +// Don't connect to Yahoo! for RSS feed tests. +// en-US only uses .types.0.uri, but set all of them just to be sure. +user_pref('browser.contentHandlers.types.0.uri', 'http://test1.example.org/rss?url=%%s') +user_pref('browser.contentHandlers.types.1.uri', 'http://test1.example.org/rss?url=%%s') +user_pref('browser.contentHandlers.types.2.uri', 'http://test1.example.org/rss?url=%%s') +user_pref('browser.contentHandlers.types.3.uri', 'http://test1.example.org/rss?url=%%s') +user_pref('browser.contentHandlers.types.4.uri', 'http://test1.example.org/rss?url=%%s') +user_pref('browser.contentHandlers.types.5.uri', 'http://test1.example.org/rss?url=%%s')

1 0

[tor-browser/esr24] Bug 996031 - Remove 455407.html crashtest. r=dholbert, a=test-only
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit fe8b28b6b5994cee3758a490b24a3d3783c984b8 Author: Nathan Froyd <froydnj(a)mozilla.com> Date: Tue Apr 15 16:31:51 2014 -0400 Bug 996031 - Remove 455407.html crashtest. r=dholbert, a=test-only The bug that this test was intended to test seems transient, according to testing with nightlies around the time the bug was filed. Additionally, the test connects to external servers, which is frowned upon and will soon be forbidden. --- layout/generic/crashtests/455407.html | 13 ------------- layout/generic/crashtests/crashtests.list | 1 - 2 files changed, 14 deletions(-) diff --git a/layout/generic/crashtests/455407.html b/layout/generic/crashtests/455407.html deleted file mode 100644 index 54d389c..0000000 --- a/layout/generic/crashtests/455407.html +++ /dev/null @@ -1,13 +0,0 @@ -<html> -<head>Crash [@ nsSubDocumentFrame::Reflow] with generated content and resizing iframe</title> -</head> -<body> -<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%3C/head%3E%3Cbody%3E%0A%3Cstyle%20id%3D%22e%22%3Ebody%3A%3Abefore%20%7B%20content%3A%22b%22%3B%20%7D%3C/style%3E%0A%3Cscript%3Ewindow.frameElement.style.width%3DMath.floor%28Math.random%28%29*100%29+%27%25%27%3B%0A%3C/script%3E%0A%3Ciframe%20src%3D%22http%3A//mozilla.org%22%3E%3C/iframe%3E%0A%3C/body%3E%3C/html%3E" onload="//doe()" style=" width:1000px;height: 200px;"></iframe> -<script> -function doe() { - document.getElementById('content').src = document.getElementById('content').src + '?1'; -} -setInterval(doe, 1000); -</script> -</body> -</html> diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list index 54891c8..adaa9d2 100644 --- a/layout/generic/crashtests/crashtests.list +++ b/layout/generic/crashtests/crashtests.list @@ -292,7 +292,6 @@ load 453762-1.html load 455171-1.html load 455171-2.html load 455171-3.html -load 455407.html load 455643-1.xhtml load 457375.html load 457380-1.html

1 0

[tor-browser/esr24] Bug 996019 - Fix browser_bug435325.js to not connect to example.com. r=ehsan, a=test-only
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 4244dc23cc57deb50607119f367eeafbcb446d6e Author: Nathan Froyd <froydnj(a)mozilla.com> Date: Tue Apr 15 16:14:10 2014 -0400 Bug 996019 - Fix browser_bug435325.js to not connect to example.com. r=ehsan, a=test-only --- browser/base/content/test/browser_bug435325.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/browser/base/content/test/browser_bug435325.js b/browser/base/content/test/browser_bug435325.js index 2e9136d..fe05c75 100644 --- a/browser/base/content/test/browser_bug435325.js +++ b/browser/base/content/test/browser_bug435325.js @@ -51,6 +51,11 @@ function checkPage() { // Now press the "Try Again" button ok(gBrowser.contentDocument.getElementById("errorTryAgain"), "The error page has got a #errorTryAgain element"); + + // Re-enable the proxy so example.com is resolved to localhost, rather than + // the actual example.com. + Services.prefs.setIntPref("network.proxy.type", proxyPrefValue); + gBrowser.contentDocument.getElementById("errorTryAgain").click(); ok(!Services.io.offline, "After clicking the Try Again button, we're back " + @@ -60,7 +65,6 @@ function checkPage() { } registerCleanupFunction(function() { - Services.prefs.setIntPref("network.proxy.type", proxyPrefValue); Services.prefs.setBoolPref("browser.cache.disk.enable", true); Services.prefs.setBoolPref("browser.cache.memory.enable", true); Services.io.offline = false;

1 0

[tor-browser/esr24] Bug 992968. r=efaust, a=sledru
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit ef9950875b05a9d4e61954cd28b50db4b2879a84 Author: Nicolas B. Pierron <nicolas.b.pierron(a)mozilla.com> Date: Thu Apr 17 09:48:42 2014 -0400 Bug 992968. r=efaust, a=sledru --- js/src/jit/CodeGenerator.cpp | 3 +++ js/src/jit/shared/CodeGenerator-shared.h | 2 ++ 2 files changed, 5 insertions(+) diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp index 534ae07..4fe0327 100644 --- a/js/src/jit/CodeGenerator.cpp +++ b/js/src/jit/CodeGenerator.cpp @@ -91,6 +91,9 @@ class OutOfLineUpdateCache : bool CodeGeneratorShared::addCache(LInstruction *lir, size_t cacheIndex) { + if (cacheIndex == SIZE_MAX) + return false; + IonCache *cache = static_cast<IonCache *>(getCache(cacheIndex)); MInstruction *mir = lir->mirRaw()->toInstruction(); if (mir->resumePoint()) diff --git a/js/src/jit/shared/CodeGenerator-shared.h b/js/src/jit/shared/CodeGenerator-shared.h index 6fdf97a..f0a7c8b 100644 --- a/js/src/jit/shared/CodeGenerator-shared.h +++ b/js/src/jit/shared/CodeGenerator-shared.h @@ -203,6 +203,8 @@ class CodeGeneratorShared : public LInstructionVisitor template <typename T> inline size_t allocateCache(const T &cache) { size_t index = allocateCache(cache, sizeof(mozilla::AlignedStorage2<T>)); + if (masm.oom()) + return SIZE_MAX; // Use the copy constructor on the allocated space. new (&runtimeData_[cacheList_.back()]) T(cache); return index;

1 0

[tor-browser/esr24] Bug 993546 - Refactor malloc-wrapping memory reporter implementations. r=njn, a=abillings
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 2861f1003fbb11e74c901d5bebc7f33be38b5396 Author: Nathan Froyd <froydnj(a)mozilla.com> Date: Tue Apr 15 13:11:59 2014 -0400 Bug 993546 - Refactor malloc-wrapping memory reporter implementations. r=njn, a=abillings --- extensions/spellcheck/hunspell/src/hunspell_alloc_hooks.h | 2 +- gfx/thebes/gfxAndroidPlatform.cpp | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/extensions/spellcheck/hunspell/src/hunspell_alloc_hooks.h b/extensions/spellcheck/hunspell/src/hunspell_alloc_hooks.h index 8c60074..60b7d33 100644 --- a/extensions/spellcheck/hunspell/src/hunspell_alloc_hooks.h +++ b/extensions/spellcheck/hunspell/src/hunspell_alloc_hooks.h @@ -84,7 +84,7 @@ inline void* hunspell_realloc(void* ptr, size_t size) void* result = moz_realloc(ptr, size); if (result) { HunspellReportMemoryAllocation(result); - } else { + } else if (size != 0) { // realloc failed; undo the HunspellReportMemoryDeallocation from above HunspellReportMemoryAllocation(ptr); } diff --git a/gfx/thebes/gfxAndroidPlatform.cpp b/gfx/thebes/gfxAndroidPlatform.cpp index b220085..b47e171 100644 --- a/gfx/thebes/gfxAndroidPlatform.cpp +++ b/gfx/thebes/gfxAndroidPlatform.cpp @@ -71,7 +71,7 @@ CountingRealloc(FT_Memory memory, long cur_size, long new_size, void* p) void *pnew = realloc(p, new_size); if (pnew) { sFreetypeMemoryUsed += FreetypeMallocSizeOfOnAlloc(pnew); - } else { + } else if (new_size != 0) { // realloc failed; undo the decrement from above sFreetypeMemoryUsed += FreetypeMallocSizeOfOnAlloc(p); }

1 0

[tor-browser/esr24] Bug 892990 - Cap waiting time for wait-for-composite in WebGL reftests. r=bjacob, a=test-only
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 2ca3c2426f1395d3939e767ab53f80e406eb6e24 Author: Jeff Gilbert <jgilbert(a)mozilla.com> Date: Mon Apr 14 15:43:57 2014 -0700 Bug 892990 - Cap waiting time for wait-for-composite in WebGL reftests. r=bjacob, a=test-only --- content/canvas/test/reftest/webgl-clear-test.html | 2 +- content/canvas/test/reftest/webgl-color-alpha-test.html | 2 +- content/canvas/test/reftest/webgl-color-test.html | 2 +- content/canvas/test/reftest/webgl-disable-test.html | 2 +- content/canvas/test/reftest/webgl-hanging-fb-test.html | 2 +- .../canvas/test/reftest/webgl-hanging-scissor-test.html | 2 +- content/canvas/test/reftest/webgl-orientation-test.html | 2 +- content/canvas/test/reftest/webgl-utils.js | 15 +++++++++++++++ 8 files changed, 22 insertions(+), 7 deletions(-) diff --git a/content/canvas/test/reftest/webgl-clear-test.html b/content/canvas/test/reftest/webgl-clear-test.html index 5fe4662..0905dea 100644 --- a/content/canvas/test/reftest/webgl-clear-test.html +++ b/content/canvas/test/reftest/webgl-clear-test.html @@ -33,7 +33,7 @@ function runTest() { else renderBackup(canvas); - rAF(testComplete); + waitForComposite(testComplete); } function testComplete() { diff --git a/content/canvas/test/reftest/webgl-color-alpha-test.html b/content/canvas/test/reftest/webgl-color-alpha-test.html index 9d568ef..45ab06a 100644 --- a/content/canvas/test/reftest/webgl-color-alpha-test.html +++ b/content/canvas/test/reftest/webgl-color-alpha-test.html @@ -85,7 +85,7 @@ function runTest() { else renderBackup(canvas, value, alpha); - rAF(testComplete); + waitForComposite(testComplete); } function testComplete() { diff --git a/content/canvas/test/reftest/webgl-color-test.html b/content/canvas/test/reftest/webgl-color-test.html index 785ef04..5455e49 100644 --- a/content/canvas/test/reftest/webgl-color-test.html +++ b/content/canvas/test/reftest/webgl-color-test.html @@ -69,7 +69,7 @@ function runTest() { else renderBackup(canvas); - rAF(testComplete); + waitForComposite(testComplete); } function testComplete() { diff --git a/content/canvas/test/reftest/webgl-disable-test.html b/content/canvas/test/reftest/webgl-disable-test.html index a46dc75..30581ec 100644 --- a/content/canvas/test/reftest/webgl-disable-test.html +++ b/content/canvas/test/reftest/webgl-disable-test.html @@ -44,7 +44,7 @@ function runTest() { else renderBackup(canvas); - rAF(testComplete); + waitForComposite(testComplete); } function testComplete() { diff --git a/content/canvas/test/reftest/webgl-hanging-fb-test.html b/content/canvas/test/reftest/webgl-hanging-fb-test.html index 4d589c4..e25356f 100644 --- a/content/canvas/test/reftest/webgl-hanging-fb-test.html +++ b/content/canvas/test/reftest/webgl-hanging-fb-test.html @@ -42,7 +42,7 @@ function runTest() { else renderBackup(canvas); - rAF(testComplete); + waitForComposite(testComplete); } function testComplete() { diff --git a/content/canvas/test/reftest/webgl-hanging-scissor-test.html b/content/canvas/test/reftest/webgl-hanging-scissor-test.html index f562447..29d1ecc 100644 --- a/content/canvas/test/reftest/webgl-hanging-scissor-test.html +++ b/content/canvas/test/reftest/webgl-hanging-scissor-test.html @@ -41,7 +41,7 @@ function runTest() { else renderBackup(canvas); - rAF(testComplete); + waitForComposite(testComplete); } function testComplete() { diff --git a/content/canvas/test/reftest/webgl-orientation-test.html b/content/canvas/test/reftest/webgl-orientation-test.html index 9e2ed2e..9fb2019 100644 --- a/content/canvas/test/reftest/webgl-orientation-test.html +++ b/content/canvas/test/reftest/webgl-orientation-test.html @@ -44,7 +44,7 @@ function runTest() { else renderBackup(canvas); - rAF(testComplete); + waitForComposite(testComplete); } function testComplete() { diff --git a/content/canvas/test/reftest/webgl-utils.js b/content/canvas/test/reftest/webgl-utils.js index 72d4b74..c17c8a1 100644 --- a/content/canvas/test/reftest/webgl-utils.js +++ b/content/canvas/test/reftest/webgl-utils.js @@ -66,3 +66,18 @@ function rAF(func) { var raf = window.requestAnimationFrame || window.mozRequestAnimationFrame; raf(func); } + +var MAX_WAIT_FOR_COMPOSITE_DELAY_MS = 500; + +function waitForComposite(func) { + var isDone = false; + var doneFunc = function () { + if (isDone) + return; + isDone = true; + func(); + }; + + rAF(doneFunc); + setTimeout(doneFunc, MAX_WAIT_FOR_COMPOSITE_DELAY_MS); +}

1 0

[tor-browser/esr24] Bug 966630 - Clamp level to TexImage operations to [0..31]. r=jgilbert, a=abillings
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit a869ef10f54cb5e4a0e5d7de293aaff526d5837d Author: Dan Glastonbury <dglastonbury(a)mozilla.com> Date: Wed Apr 16 16:31:53 2014 +1000 Bug 966630 - Clamp level to TexImage operations to [0..31]. r=jgilbert, a=abillings --- content/canvas/src/WebGLContextValidate.cpp | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/content/canvas/src/WebGLContextValidate.cpp b/content/canvas/src/WebGLContextValidate.cpp index b364633..46a39d3 100644 --- a/content/canvas/src/WebGLContextValidate.cpp +++ b/content/canvas/src/WebGLContextValidate.cpp @@ -502,6 +502,19 @@ bool WebGLContext::ValidateLevelWidthHeightForTarget(WebGLenum target, WebGLint return false; } + /* Bug 966630: maxTextureSize >> level runs into "undefined" + * behaviour depending on ISA. For example, on Intel shifts + * amounts are mod 64 (in 64-bit mode on 64-bit dest) and mod 32 + * otherwise. This means 16384 >> 0x10000001 == 8192 which isn't + * what would be expected. Make the required behaviour explicit by + * clamping to a shift of 31 bits if level is greater than that + * ammount. This will give 0 that if (!maxAllowedSize) is + * expecting. + */ + + if (level > 31) + level = 31; + WebGLsizei maxAllowedSize = maxTextureSize >> level; if (!maxAllowedSize) { @@ -1023,7 +1036,7 @@ WebGLContext::InitAndValidateGL() default: GenerateWarning("GL error 0x%x occurred during WebGL context initialization!", error); return false; - } + } } }

1 0