Closed
Bug 963839
Opened 12 years ago
Closed 6 years ago
Requesting a WebGL canvas of above a certain size causes hardcrash
Categories
(Core :: Graphics: CanvasWebGL, defect, P2)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: jgilbert, Assigned: jgilbert)
Details
(Keywords: sec-vector)
Attachments
(2 files)
|
1.88 KB,
patch
|
bjacob
:
review-
|
Details | Diff | Splinter Review |
|
10.66 KB,
patch
|
Details | Diff | Splinter Review |
While working on bug 847714, I found that I could hardcrash my mac with very large resize requests. Root-causing this seems to show a crash when we request a WebGL canvas of size 14186^2 or larger. Further fidgeting shows that it seems to be a max pixel count, as 14000x14200 or similar works.
MAX_TEXTURE_SIZE on this machine is 16384 by default. We should reduce this such that we don't get this issue.
| Assignee | ||
Comment 1•12 years ago
|
||
Notably, 100 repeated resizes between 14185 and 14184 exhibits no bad behavior.
| Assignee | ||
Comment 2•12 years ago
|
||
Attachment #8365399 -
Flags: review?(bjacob)
| Assignee | ||
Comment 3•12 years ago
|
||
Attachment #8365400 -
Flags: review?(bjacob)
Comment 4•12 years ago
|
||
At some point, Chrome limited drawingbuffer dimensions to 4096. Maybe we should check that they are still doing it, and if so, do the same.
Comment 5•12 years ago
|
||
Comment on attachment 8365399 [details] [diff] [review]
patch: Add hidden prefs for testing size limits
Review of attachment 8365399 [details] [diff] [review]:
-----------------------------------------------------------------
::: gfx/gl/GLContext.cpp
@@ +1085,5 @@
>
> + if (DebugMode()) {
> + uint32_t maxTexSize = Preferences::GetUint("gl.max-tex-size" , (uint32_t)0);
> + uint32_t maxRBSize = Preferences::GetUint("gl.max-rb-size" , (uint32_t)0);
> + uint32_t maxCubeSize = Preferences::GetUint("gl.max-cube-size", (uint32_t)0);
Unfortunately, it is "illegal" to call the Preferences API off the main thread. You would have to move this to gfxPlatform, or convince people maintaining the preferences API to change their mind.
(I am almost tempted to disregard this as this is just a debugging helper, but I'll try not to be too naughty this time. I feel sorry to r- a patch and be requesting it to be made less good instead).
Attachment #8365399 -
Flags: review?(bjacob) → review-
Comment 6•12 years ago
|
||
Comment on attachment 8365400 [details] [diff] [review]
patch: Add limits for Mac+ATI and include test pages to facilitate future similar testing
Review of attachment 8365400 [details] [diff] [review]:
-----------------------------------------------------------------
This patch depends on the previous one, so we need to clear the situation there first.
Attachment #8365400 -
Flags: review?(bjacob)
Comment 7•12 years ago
|
||
If this is older than trunk, we need a security rating for this and the bug should go through the sec-approval process to checkin.
https://wiki.mozilla.org/Security/Bug_Approval_Process
| Assignee | ||
Updated•12 years ago
|
Keywords: sec-vector
| Assignee | ||
Updated•12 years ago
|
status-firefox26:
--- → ?
status-firefox27:
--- → ?
status-firefox28:
--- → ?
status-firefox29:
--- → affected
status-firefox-esr24:
--- → ?
Updated•10 years ago
|
Group: core-security → gfx-core-security
Updated•9 years ago
|
status-firefox26:
? → ---
status-firefox27:
? → ---
status-firefox28:
? → ---
status-firefox29:
affected → ---
status-firefox-esr24:
? → ---
| Assignee | ||
Comment 9•7 years ago
|
||
My late-2013 15" MBP on NV dGPU seems to handle creating a webgl context for 15000x15000 ok, but I don't have an AMD GPU machine right now. I'll find one.
I suspect this will be WFM, though.
| Assignee | ||
Updated•6 years ago
|
Flags: needinfo?(jgilbert)
Priority: -- → P2
| Assignee | ||
Comment 10•6 years ago
|
||
kamidphish tested on AMD and it seems fine, so closing.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WORKSFORME
Updated•6 years ago
|
Group: gfx-core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•