This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch tor-browser-91.8.0esr-11.0-1 in repository tor-browser.
commit c9933ca9561f6c645343864fa6b90258bb6ab4ad Author: Kelsey Gilbert kelsey.gilbert@mozilla.com AuthorDate: Wed Mar 23 18:02:46 2022 +0000
Bug 1744525 - Prevent too-high vert-count draws on Mesa. r=lsalzman a=RyanVM
Differential Revision: https://phabricator.services.mozilla.com/D141883 --- dom/canvas/WebGLContextDraw.cpp | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/dom/canvas/WebGLContextDraw.cpp b/dom/canvas/WebGLContextDraw.cpp index d5f7b7ca2b26b..459f7722b39db 100644 --- a/dom/canvas/WebGLContextDraw.cpp +++ b/dom/canvas/WebGLContextDraw.cpp @@ -976,7 +976,17 @@ WebGLVertexAttrib0Status WebGLContext::WhatDoesVertexAttrib0Need() const { : WebGLVertexAttrib0Status::EmulatedInitializedArray; }
-bool WebGLContext::DoFakeVertexAttrib0(const uint64_t vertexCount) { +bool WebGLContext::DoFakeVertexAttrib0(const uint64_t totalVertCount) { + if (gl->WorkAroundDriverBugs() && gl->IsMesa()) { + // Padded/strided to vec4, so 4x4bytes. + const auto effectiveVertAttribBytes = + CheckedInt<int32_t>(totalVertCount) * 4 * 4; + if (!effectiveVertAttribBytes.isValid()) { + ErrorOutOfMemory("`offset + count` too large for Mesa."); + return false; + } + } + const auto whatDoesAttrib0Need = WhatDoesVertexAttrib0Need(); if (MOZ_LIKELY(whatDoesAttrib0Need == WebGLVertexAttrib0Status::Default)) return true; @@ -1019,14 +1029,14 @@ bool WebGLContext::DoFakeVertexAttrib0(const uint64_t vertexCount) { ////
const auto bytesPerVert = sizeof(mFakeVertexAttrib0Data); - const auto checked_dataSize = CheckedUint32(vertexCount) * bytesPerVert; + const auto checked_dataSize = CheckedUint32(totalVertCount) * bytesPerVert; if (!checked_dataSize.isValid()) { ErrorOutOfMemory( "Integer overflow trying to construct a fake vertex attrib 0" " array for a draw-operation with %" PRIu64 " vertices. Try" " reducing the number of vertices.", - vertexCount); + totalVertCount); return false; } const auto dataSize = checked_dataSize.value();