This is an automated email from the git hooks/post-receive script.
pierov pushed a commit to branch geckoview-99.0.1-11.0-1 in repository tor-browser.
commit afd3dd1aebde69c3093a08abd5f3d291d1370cfd Author: Andrew Osmond aosmond@mozilla.com AuthorDate: Tue Mar 15 23:25:25 2022 +0000
Bug 1757755 - Add size validation when restoring a WebGL context. r=jgilbert a=dmeehan
This matches the validation done in ClientWebGLContext::SetDimensions.
Differential Revision: https://phabricator.services.mozilla.com/D141136 --- dom/canvas/ClientWebGLContext.cpp | 7 +++++++ dom/canvas/crashtests/1757755.html | 18 ++++++++++++++++++ dom/canvas/crashtests/crashtests.list | 1 + 3 files changed, 26 insertions(+)
diff --git a/dom/canvas/ClientWebGLContext.cpp b/dom/canvas/ClientWebGLContext.cpp index f27ae5b46637c..5a0e938ab2341 100644 --- a/dom/canvas/ClientWebGLContext.cpp +++ b/dom/canvas/ClientWebGLContext.cpp @@ -291,6 +291,13 @@ void ClientWebGLContext::Event_webglcontextrestored() const { return; }
+ if (!requestSize.x) { + requestSize.x = 1; + } + if (!requestSize.y) { + requestSize.y = 1; + } + const auto mutThis = const_cast<ClientWebGLContext*>( this); // TODO: Make context loss non-mutable. if (!mutThis->CreateHostContext(requestSize)) { diff --git a/dom/canvas/crashtests/1757755.html b/dom/canvas/crashtests/1757755.html new file mode 100644 index 0000000000000..4e222f79cd5c4 --- /dev/null +++ b/dom/canvas/crashtests/1757755.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> + +window.addEventListener("load", () => { + const canvas = document.createElement('canvas'); + const context = canvas.getContext("webgl"); + const extension = context.getExtension("WEBGL_lose_context"); + extension.loseContext(); + extension.restoreContext(); + canvas.height = 0; +}); + +</script> +</head> +</html> diff --git a/dom/canvas/crashtests/crashtests.list b/dom/canvas/crashtests/crashtests.list index 7fd638710bc86..75435102bf209 100644 --- a/dom/canvas/crashtests/crashtests.list +++ b/dom/canvas/crashtests/crashtests.list @@ -61,3 +61,4 @@ load 1739454-1.html load 1740031.html pref(webgl.enable-privileged-extensions,true) load 1744172.html load 1757925-1.html +load 1757755.html