Closed Bug 1307257 Opened 3 years ago Closed 3 years ago

Framebuffer11::invalidateBase can crash

Categories

(Core :: Canvas: WebGL, defect, P1)

49 Branch
defect

Tracking

()

RESOLVED FIXED
mozilla52
Tracking Status
firefox51 --- fixed
firefox52 --- fixed

People

(Reporter: milan, Assigned: milan, NeedInfo)

Details

(Whiteboard: [gfx-noted])

Attachments

(1 file)

Unlike the rest of the places that call getColorAttachment() function, Framebuffer11::invalidateBase uses the return value without checking for null.  When that returns null, we crash.
Priority: -- → P1
Whiteboard: [gfx-noted]
Morris, if this passes your review, could you get Jeff to take a look (and if OK) land, and arrange for upstream?
We'll also want to uplift this to at least 51.
Comment on attachment 8797289 [details]
Bug 1307257: Check for getColorAttachment returning null before using it.

https://reviewboard.mozilla.org/r/82888/#review81592

LGTM
Attachment #8797289 - Flags: review?(mtseng) → review+
Thanks for looking into this. This crash is also reproducible in 51 and 52.
Comment on attachment 8797289 [details]
Bug 1307257: Check for getColorAttachment returning null before using it.

https://reviewboard.mozilla.org/r/82888/#review82514

InvalidateFramebuffer is supposed to ignore missing attachments.
Attachment #8797289 - Flags: review?(jgilbert) → review+
Morris, can you make sure this gets up-streamed?
Assignee: nobody → milan
Flags: needinfo?(mtseng)
Pushed by msreckovic@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/9d162f236562
Check for getColorAttachment returning null before using it. r=jgilbert,mtseng
https://hg.mozilla.org/mozilla-central/rev/9d162f236562
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla52
Sure, keep the ni flag for reminding me.(In reply to Milan Sreckovic [:milan] from comment #7)
> Morris, can you make sure this gets up-streamed?

Sure, keep the ni flag for reminding me. I'll also add this patch to our tracked angle repo.
Comment on attachment 8797289 [details]
Bug 1307257: Check for getColorAttachment returning null before using it.

Approval Request Comment
This is tied to WebGL2 for 51.
Attachment #8797289 - Flags: approval-mozilla-aurora?
Comment on attachment 8797289 [details]
Bug 1307257: Check for getColorAttachment returning null before using it.

Fix a potential crash. Take it in 51 aurora.
Attachment #8797289 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
I have pushed the patch to our tracked ANGLE repo. 
See https://github.com/mozilla/angle/commits/mozilla

I'll do upstream next.
You need to log in before you can comment on or make changes to this bug.