Changeset 279331 in webkit

Timestamp:

Jun 28, 2021, 4:52:38 AM (5 years ago)

Author:

Adrian Perez de Castro

Message:

Merge r278152 - Cherry-pick ANGLE: D3D11: Skip blits if there is no intersection of dest areas
​https://bugs.webkit.org/show_bug.cgi?id=225190
<rdar://77084155>

Patch by Kimmo Kinnunen <​kkinnunen@apple.com> on 2021-05-27
Reviewed by David Kilzer.

Cherry-pick ANGLE commit b574643ef28c92fcea5122dd7a72acb42a514eed
Fixes a security issue on D3D11.
Potential a correctness issue on some OpenGL drivers.
No effect on Metal, but the nodiscard part is still useful.

Upstream description:
D3D11: Skip blits if there is no intersection of dest areas

Blit11 would clip the destination rectangle with the destination size
but ignore the result. gl::ClipRectangle returns false when the
rectangles do not intersect at all, indicating the blit can be skipped.

This could lead to an out-of-bounds write to the GPU memory for the
destination texture.

Mark ClipRectangle as nodiscard to prevent future issues.

• src/libANGLE/angletypes.h:
• src/libANGLE/renderer/d3d/d3d11/Blit11.cpp:
• src/libANGLE/renderer/gl/FramebufferGL.cpp:

(rx::FramebufferGL::clipSrcRegion):

• src/libANGLE/renderer/metal/ContextMtl.mm:

(rx::ContextMtl::updateScissor):

• src/libANGLE/renderer/vulkan/ContextVk.cpp:

(rx::ContextVk::updateScissor):

• src/tests/gl_tests/BlitFramebufferANGLETest.cpp:

(TEST_P):

Location:

releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE

Files:

• ChangeLog (modified) (1 diff)
• src/libANGLE/angletypes.h (modified) (1 diff)
• src/libANGLE/renderer/d3d/d3d11/Blit11.cpp (modified) (1 diff)
• src/libANGLE/renderer/gl/FramebufferGL.cpp (modified) (1 diff)
• src/libANGLE/renderer/metal/ContextMtl.mm (modified) (1 diff)
• src/libANGLE/renderer/vulkan/ContextVk.cpp (modified) (1 diff)
• src/tests/gl_tests/BlitFramebufferANGLETest.cpp (modified) (1 diff)

releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/ChangeLog

@@ +1 @@
+2021-05-27  Kimmo Kinnunen  <kkinnunen@apple.com>
+
+        Cherry-pick ANGLE: D3D11: Skip blits if there is no intersection of dest areas
+        https://bugs.webkit.org/show_bug.cgi?id=225190
+        <rdar://77084155>
+
+        Reviewed by David Kilzer.
+
+        Cherry-pick ANGLE commit b574643ef28c92fcea5122dd7a72acb42a514eed
+        Fixes a security issue on D3D11.
+        Potential a correctness issue on some OpenGL drivers.
+        No effect on Metal, but the nodiscard part is still useful.
+
+        Upstream description:
+        D3D11: Skip blits if there is no intersection of dest areas
+
+        Blit11 would clip the destination rectangle with the destination size
+        but ignore the result. gl::ClipRectangle returns false when the
+        rectangles do not intersect at all, indicating the blit can be skipped.
+
+        This could lead to an out-of-bounds write to the GPU memory for the
+        destination texture.
+
+        Mark ClipRectangle as nodiscard to prevent future issues.
+        * src/libANGLE/angletypes.h:
+        * src/libANGLE/renderer/d3d/d3d11/Blit11.cpp:
+        * src/libANGLE/renderer/gl/FramebufferGL.cpp:
+        (rx::FramebufferGL::clipSrcRegion):
+        * src/libANGLE/renderer/metal/ContextMtl.mm:
+        (rx::ContextMtl::updateScissor):
+        * src/libANGLE/renderer/vulkan/ContextVk.cpp:
+        (rx::ContextVk::updateScissor):
+        * src/tests/gl_tests/BlitFramebufferANGLETest.cpp:
+        (TEST_P):
+
 2021-02-25  Kyle Piddington  <kpiddington@apple.com>
 

releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/angletypes.h

@@ -85 +85 @@
 
 // Calculate the intersection of two rectangles.  Returns false if the intersection is empty.
-bool ClipRectangle(const Rectangle &source, const Rectangle &clip, Rectangle *intersection);
+ANGLE_NO_DISCARD bool ClipRectangle(const Rectangle &source,
+                                    const Rectangle &clip,
+                                    Rectangle *intersection);
 // Calculate the smallest rectangle that covers both rectangles.  This rectangle may cover areas
 // not covered by the two rectangles, for example in this situation:

releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Blit11.cpp

@@ -142 +142 @@
 {
     gl::Rectangle clippedDestArea(destArea.x, destArea.y, destArea.width, destArea.height);
-    gl::ClipRectangle(clippedDestArea, clipRect, &clippedDestArea);
+    if (!gl::ClipRectangle(clippedDestArea, clipRect, &clippedDestArea))
+    {
+        return;
+    }
 
     // Determine if entire rows can be copied at once instead of each individual pixel. There

releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/FramebufferGL.cpp

@@ -1118 +1118 @@
         // and dst region to appropriate in-bounds regions respectively.
         gl::Rectangle realSourceRegion;
-        ClipRectangle(bounds.sourceRegion, bounds.sourceBounds, &realSourceRegion);
+        if (!ClipRectangle(bounds.sourceRegion, bounds.sourceBounds, &realSourceRegion))
+        {
+            return angle::Result::Stop;
+        }
         GLuint xOffset = realSourceRegion.x - bounds.sourceRegion.x;
         GLuint yOffset = realSourceRegion.y - bounds.sourceRegion.y;

releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.mm

@@ -1837 +1837 @@
     // Clip the render area to the viewport.
     gl::Rectangle viewportClippedRenderArea;
-    gl::ClipRectangle(renderArea, glState.getViewport(), &viewportClippedRenderArea);
+    if (!gl::ClipRectangle(renderArea, glState.getViewport(), &viewportClippedRenderArea))
+    {
+        viewportClippedRenderArea = gl::Rectangle();
+    }
 
     gl::Rectangle scissoredArea = ClipRectToScissor(getState(), viewportClippedRenderArea, false);

releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ContextVk.cpp

@@ -2617 +2617 @@
     // Clip the render area to the viewport.
     gl::Rectangle viewportClippedRenderArea;
-    gl::ClipRectangle(renderArea, getCorrectedViewport(glState.getViewport()),
-                      &viewportClippedRenderArea);
+    if (!gl::ClipRectangle(renderArea, getCorrectedViewport(glState.getViewport()),
+                           &viewportClippedRenderArea))
+    {
+        viewportClippedRenderArea = gl::Rectangle();
+    }
 
     gl::Rectangle scissoredArea = ClipRectToScissor(getState(), viewportClippedRenderArea, false);

releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/tests/gl_tests/BlitFramebufferANGLETest.cpp

@@ -2438 +2438 @@
 }
 
+// Test an edge case in D3D11 stencil blitting on the CPU that does not properly clip the
+// destination regions
+TEST_P(BlitFramebufferTest, BlitFramebufferStencilClipNoIntersection)
+{
+    GLFramebuffer framebuffers[2];
+    glBindFramebuffer(GL_READ_FRAMEBUFFER, framebuffers[0]);
+    glBindFramebuffer(GL_DRAW_FRAMEBUFFER, framebuffers[1]);
+
+    GLRenderbuffer renderbuffers[2];
+    glBindRenderbuffer(GL_RENDERBUFFER, renderbuffers[0]);
+    glRenderbufferStorage(GL_RENDERBUFFER, GL_DEPTH24_STENCIL8, 4, 4);
+    glFramebufferRenderbuffer(GL_READ_FRAMEBUFFER, GL_STENCIL_ATTACHMENT, GL_RENDERBUFFER,
+                              renderbuffers[0]);
+
+    glBindRenderbuffer(GL_RENDERBUFFER, renderbuffers[1]);
+    glRenderbufferStorage(GL_RENDERBUFFER, GL_DEPTH24_STENCIL8, 4, 4);
+    glFramebufferRenderbuffer(GL_DRAW_FRAMEBUFFER, GL_STENCIL_ATTACHMENT, GL_RENDERBUFFER,
+                              renderbuffers[1]);
+
+    glBlitFramebuffer(0, 0, 4, 4, 1 << 24, 1 << 24, 1 << 25, 1 << 25, GL_STENCIL_BUFFER_BIT,
+                      GL_NEAREST);
+    EXPECT_GL_NO_ERROR();
+}
+
 // Use this to select which configurations (e.g. which renderer, which GLES major version) these
 // tests should be run against.