[tor-commits] [tor-browser] 61/76: Bug 1744525 - Prevent too-high vert-count draws on Mesa. r=lsalzman a=RyanVM

[gitolite role <git@xxxxxxxxxxxxxxxxxxxxx>]

This is an automated email from the git hooks/post-receive script.

richard pushed a commit to branch tor-browser-91.8.0esr-11.0-1
in repository tor-browser.

commit c9933ca9561f6c645343864fa6b90258bb6ab4ad
Author: Kelsey Gilbert <kelsey.gilbert@xxxxxxxxxxx>
AuthorDate: Wed Mar 23 18:02:46 2022 +0000

    Bug 1744525 - Prevent too-high vert-count draws on Mesa. r=lsalzman a=RyanVM
    
    Differential Revision: https://phabricator.services.mozilla.com/D141883
---
 dom/canvas/WebGLContextDraw.cpp | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/dom/canvas/WebGLContextDraw.cpp b/dom/canvas/WebGLContextDraw.cpp
index d5f7b7ca2b26b..459f7722b39db 100644
--- a/dom/canvas/WebGLContextDraw.cpp
+++ b/dom/canvas/WebGLContextDraw.cpp
@@ -976,7 +976,17 @@ WebGLVertexAttrib0Status WebGLContext::WhatDoesVertexAttrib0Need() const {
              : WebGLVertexAttrib0Status::EmulatedInitializedArray;
 }
 
-bool WebGLContext::DoFakeVertexAttrib0(const uint64_t vertexCount) {
+bool WebGLContext::DoFakeVertexAttrib0(const uint64_t totalVertCount) {
+  if (gl->WorkAroundDriverBugs() && gl->IsMesa()) {
+    // Padded/strided to vec4, so 4x4bytes.
+    const auto effectiveVertAttribBytes =
+        CheckedInt<int32_t>(totalVertCount) * 4 * 4;
+    if (!effectiveVertAttribBytes.isValid()) {
+      ErrorOutOfMemory("`offset + count` too large for Mesa.");
+      return false;
+    }
+  }
+
   const auto whatDoesAttrib0Need = WhatDoesVertexAttrib0Need();
   if (MOZ_LIKELY(whatDoesAttrib0Need == WebGLVertexAttrib0Status::Default))
     return true;
@@ -1019,14 +1029,14 @@ bool WebGLContext::DoFakeVertexAttrib0(const uint64_t vertexCount) {
   ////
 
   const auto bytesPerVert = sizeof(mFakeVertexAttrib0Data);
-  const auto checked_dataSize = CheckedUint32(vertexCount) * bytesPerVert;
+  const auto checked_dataSize = CheckedUint32(totalVertCount) * bytesPerVert;
   if (!checked_dataSize.isValid()) {
     ErrorOutOfMemory(
         "Integer overflow trying to construct a fake vertex attrib 0"
         " array for a draw-operation with %" PRIu64
         " vertices. Try"
         " reducing the number of vertices.",
-        vertexCount);
+        totalVertCount);
     return false;
   }
   const auto dataSize = checked_dataSize.value();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits