1533525 - WebGL converts freely from WebGLintptr to GLintptr, which truncates on 32bit (also WebGLsizeiptr->GLsizeiptr)

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, enhancement, P1)

Description

[Kelsey Gilbert [:jgilbert]]

This isn't necessarily dangerous, but it is risky.
Best case, we just truncate the requests consistently, which is incorrect, but safe.
Worst case would be if we're inconsistent.

Just to be safe, marking this sec, but it's probably not an issue.

Comment 1

[Kelsey Gilbert [:jgilbert]]

Attachment: Bug 1533525 - Don't freely convert WebGL(int|sizei)ptr to GL(int|sizei)ptr.

Comment 2

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Landed: https://hg.mozilla.org/integration/mozilla-inbound/rev/bdc40c000b29ba024a7014d3ff5fc31d98e608df
Backed out for build bustages in WebGLTypes.h: https://hg.mozilla.org/integration/mozilla-inbound/rev/36570e7c5eb7191101d786823427ed70707e5606

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&resultStatus=pending%2Crunning%2Ctestfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel%2Crunnable&tier=1%2C2%2C3&group_state=expanded&selectedJob=239207331&revision=bdc40c000b29ba024a7014d3ff5fc31d98e608df

Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=239227194&repo=mozilla-inbound

[task 2019-04-10T00:11:25.088Z] 00:11:25 INFO - In file included from /builds/worker/workspace/build/src/dom/canvas/TexUnpackBlob.h:12:
[task 2019-04-10T00:11:25.089Z] 00:11:25 ERROR - /builds/worker/workspace/build/src/dom/canvas/WebGLTypes.h:42:5: error: static_assert failed due to requirement 'std::numeric_limits<unsigned long long>::max() <= std::numeric_limits<unsigned int>::max()' "SrcT must be narrower than DestT."
[task 2019-04-10T00:11:25.089Z] 00:11:25 INFO - static_assert(
[task 2019-04-10T00:11:25.089Z] 00:11:25 INFO - ^
[task 2019-04-10T00:11:25.089Z] 00:11:25 INFO - /builds/worker/workspace/build/src/dom/canvas/WebGLBuffer.cpp:109:28: note: in instantiation of function template specialization 'mozilla::ForbidNarrowing<unsigned int>::ForbidNarrowing<unsigned long long>' requested here
[task 2019-04-10T00:11:25.090Z] 00:11:25 INFO - newIndexCache = malloc(size);
[task 2019-04-10T00:11:25.090Z] 00:11:25 INFO - ^
[task 2019-04-10T00:11:25.090Z] 00:11:25 INFO - 1 error generated.
[task 2019-04-10T00:11:25.090Z] 00:11:25 INFO - /builds/worker/workspace/build/src/config/rules.mk:805: recipe for target 'Unified_cpp_dom_canvas1.o' failed
[task 2019-04-10T00:11:25.091Z] 00:11:25 ERROR - make[4]: *** [Unified_cpp_dom_canvas1.o] Error 1
[task 2019-04-10T00:11:25.091Z] 00:11:25 INFO - make[4]: Leaving directory '/builds/worker/workspace/build/src/obj-firefox/dom/canvas'
[task 2019-04-10T00:11:25.091Z] 00:11:25 INFO - make[4]: *** Waiting for unfinished jobs....

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/256eff8cc0f8c1a7c3a37dc75353474c3309f900
https://hg.mozilla.org/mozilla-central/rev/256eff8cc0f8