[tbb-commits] [tor-browser] 165/311: Bug 1757755 - Add size validation when restoring a WebGL context. r=jgilbert a=dmeehan

Tue Apr 26 15:29:25 UTC 2022

This is an automated email from the git hooks/post-receive script.

pierov pushed a commit to branch geckoview-99.0.1-11.0-1
in repository tor-browser.

commit afd3dd1aebde69c3093a08abd5f3d291d1370cfd
Author: Andrew Osmond <aosmond at mozilla.com>
AuthorDate: Tue Mar 15 23:25:25 2022 +0000

    Bug 1757755 - Add size validation when restoring a WebGL context. r=jgilbert a=dmeehan
    
    This matches the validation done in ClientWebGLContext::SetDimensions.
    
    Differential Revision: https://phabricator.services.mozilla.com/D141136
---
 dom/canvas/ClientWebGLContext.cpp     |  7 +++++++
 dom/canvas/crashtests/1757755.html    | 18 ++++++++++++++++++
 dom/canvas/crashtests/crashtests.list |  1 +
 3 files changed, 26 insertions(+)

diff --git a/dom/canvas/ClientWebGLContext.cpp b/dom/canvas/ClientWebGLContext.cpp
index f27ae5b46637c..5a0e938ab2341 100644
--- a/dom/canvas/ClientWebGLContext.cpp
+++ b/dom/canvas/ClientWebGLContext.cpp
@@ -291,6 +291,13 @@ void ClientWebGLContext::Event_webglcontextrestored() const {
     return;
   }
 
+  if (!requestSize.x) {
+    requestSize.x = 1;
+  }
+  if (!requestSize.y) {
+    requestSize.y = 1;
+  }
+
   const auto mutThis = const_cast<ClientWebGLContext*>(
       this);  // TODO: Make context loss non-mutable.
   if (!mutThis->CreateHostContext(requestSize)) {
diff --git a/dom/canvas/crashtests/1757755.html b/dom/canvas/crashtests/1757755.html
new file mode 100644
index 0000000000000..4e222f79cd5c4
--- /dev/null
+++ b/dom/canvas/crashtests/1757755.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+
+window.addEventListener("load", () => {
+  const canvas = document.createElement('canvas');
+  const context = canvas.getContext("webgl");
+  const extension = context.getExtension("WEBGL_lose_context");
+  extension.loseContext();
+  extension.restoreContext();
+  canvas.height = 0;
+});
+
+</script>
+</head>
+</html>
diff --git a/dom/canvas/crashtests/crashtests.list b/dom/canvas/crashtests/crashtests.list
index 7fd638710bc86..75435102bf209 100644
--- a/dom/canvas/crashtests/crashtests.list
+++ b/dom/canvas/crashtests/crashtests.list
@@ -61,3 +61,4 @@ load 1739454-1.html
 load 1740031.html
 pref(webgl.enable-privileged-extensions,true) load 1744172.html
 load 1757925-1.html
+load 1757755.html

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
