commit a869ef10f54cb5e4a0e5d7de293aaff526d5837d Author: Dan Glastonbury dglastonbury@mozilla.com Date: Wed Apr 16 16:31:53 2014 +1000

Bug 966630 - Clamp level to TexImage operations to [0..31]. r=jgilbert, a=abillings --- content/canvas/src/WebGLContextValidate.cpp | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/content/canvas/src/WebGLContextValidate.cpp b/content/canvas/src/WebGLContextValidate.cpp index b364633..46a39d3 100644 --- a/content/canvas/src/WebGLContextValidate.cpp +++ b/content/canvas/src/WebGLContextValidate.cpp @@ -502,6 +502,19 @@ bool WebGLContext::ValidateLevelWidthHeightForTarget(WebGLenum target, WebGLint return false; }

+ /* Bug 966630: maxTextureSize >> level runs into "undefined" + * behaviour depending on ISA. For example, on Intel shifts + * amounts are mod 64 (in 64-bit mode on 64-bit dest) and mod 32 + * otherwise. This means 16384 >> 0x10000001 == 8192 which isn't + * what would be expected. Make the required behaviour explicit by + * clamping to a shift of 31 bits if level is greater than that + * ammount. This will give 0 that if (!maxAllowedSize) is + * expecting. + */ + + if (level > 31) + level = 31; + WebGLsizei maxAllowedSize = maxTextureSize >> level;

if (!maxAllowedSize) { @@ -1023,7 +1036,7 @@ WebGLContext::InitAndValidateGL() default: GenerateWarning("GL error 0x%x occurred during WebGL context initialization!", error); return false; - } + } } }