This is an automated email from the git hooks/post-receive script.
pierov pushed a commit to branch geckoview-99.0.1-11.0-1 in repository tor-browser.
commit f907e323b957397e3deee75108dae250736852a7 Author: Kelsey Gilbert kelsey.gilbert@mozilla.com AuthorDate: Wed Mar 23 18:02:46 2022 +0000
Bug 1744525 - (beta) Prevent too-high vert-count draws on Mesa. r=lsalzman a=dmeehan
Differential Revision: https://phabricator.services.mozilla.com/D141883 --- dom/canvas/WebGLContextDraw.cpp | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/dom/canvas/WebGLContextDraw.cpp b/dom/canvas/WebGLContextDraw.cpp index 8bc7cf9907e92..f00257d777c0d 100644 --- a/dom/canvas/WebGLContextDraw.cpp +++ b/dom/canvas/WebGLContextDraw.cpp @@ -1008,7 +1008,17 @@ WebGLVertexAttrib0Status WebGLContext::WhatDoesVertexAttrib0Need() const { : WebGLVertexAttrib0Status::EmulatedInitializedArray; }
-bool WebGLContext::DoFakeVertexAttrib0(const uint64_t vertexCount) { +bool WebGLContext::DoFakeVertexAttrib0(const uint64_t totalVertCount) { + if (gl->WorkAroundDriverBugs() && gl->IsMesa()) { + // Padded/strided to vec4, so 4x4bytes. + const auto effectiveVertAttribBytes = + CheckedInt<int32_t>(totalVertCount) * 4 * 4; + if (!effectiveVertAttribBytes.isValid()) { + ErrorOutOfMemory("`offset + count` too large for Mesa."); + return false; + } + } + const auto whatDoesAttrib0Need = WhatDoesVertexAttrib0Need(); if (MOZ_LIKELY(whatDoesAttrib0Need == WebGLVertexAttrib0Status::Default)) return true; @@ -1051,14 +1061,14 @@ bool WebGLContext::DoFakeVertexAttrib0(const uint64_t vertexCount) { ////
const auto bytesPerVert = sizeof(mFakeVertexAttrib0Data); - const auto checked_dataSize = CheckedUint32(vertexCount) * bytesPerVert; + const auto checked_dataSize = CheckedUint32(totalVertCount) * bytesPerVert; if (!checked_dataSize.isValid()) { ErrorOutOfMemory( "Integer overflow trying to construct a fake vertex attrib 0" " array for a draw-operation with %" PRIu64 " vertices. Try" " reducing the number of vertices.", - vertexCount); + totalVertCount); return false; } const auto dataSize = checked_dataSize.value();