[tor-commits] [tor-browser/esr24] Bug 966630 - Clamp level to TexImage operations to [0..31]. r=jgilbert, a=abillings

[mikeperry at torproject.org]

commit a869ef10f54cb5e4a0e5d7de293aaff526d5837d
Author: Dan Glastonbury <dglastonbury at mozilla.com>
Date:   Wed Apr 16 16:31:53 2014 +1000

    Bug 966630 - Clamp level to TexImage operations to [0..31]. r=jgilbert, a=abillings
---
 content/canvas/src/WebGLContextValidate.cpp |   15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/content/canvas/src/WebGLContextValidate.cpp b/content/canvas/src/WebGLContextValidate.cpp
index b364633..46a39d3 100644
--- a/content/canvas/src/WebGLContextValidate.cpp
+++ b/content/canvas/src/WebGLContextValidate.cpp
@@ -502,6 +502,19 @@ bool WebGLContext::ValidateLevelWidthHeightForTarget(WebGLenum target, WebGLint
         return false;
     }
 
+    /* Bug 966630: maxTextureSize >> level runs into "undefined"
+     * behaviour depending on ISA. For example, on Intel shifts
+     * amounts are mod 64 (in 64-bit mode on 64-bit dest) and mod 32
+     * otherwise. This means 16384 >> 0x10000001 == 8192 which isn't
+     * what would be expected. Make the required behaviour explicit by
+     * clamping to a shift of 31 bits if level is greater than that
+     * ammount. This will give 0 that if (!maxAllowedSize) is
+     * expecting.
+     */
+
+    if (level > 31)
+        level = 31;
+
     WebGLsizei maxAllowedSize = maxTextureSize >> level;
 
     if (!maxAllowedSize) {
@@ -1023,7 +1036,7 @@ WebGLContext::InitAndValidateGL()
                 default:
                     GenerateWarning("GL error 0x%x occurred during WebGL context initialization!", error);
                     return false;
-            }   
+            }
         }
     }