Changeset 281613 in webkit

Timestamp:

Aug 25, 2021, 8:37:36 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Crash in GraphicsContextGLOpenGL::reshapeDisplayBufferBacking
​https://bugs.webkit.org/show_bug.cgi?id=229309

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-08-25
Reviewed by Myles C. Maxfield.

Source/WebCore:

Test: fast/canvas/xr-compatible-crash.html

Null check m_swapChain because reshapeDisplayBufferBacking can be called before it is set.

• html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::WebGLRenderingContextBase::addContextObject):

• platform/graphics/angle/GraphicsContextGLANGLE.cpp:

(WebCore::GraphicsContextGLOpenGL::reshapeFBOs):

• platform/graphics/cocoa/GraphicsContextGLOpenGLCocoa.mm:

(WebCore::GraphicsContextGLOpenGL::reshapeDisplayBufferBacking):

LayoutTests:

• fast/canvas/xr-compatible-crash.html: Added.
• fast/canvas/xr-compatible-crash-expected.txt: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/canvas/xr-compatible-crash-expected.txt (added)
• LayoutTests/fast/canvas/xr-compatible-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp (modified) (1 diff)
• Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp (modified) (1 diff)
• Source/WebCore/platform/graphics/cocoa/GraphicsContextGLOpenGLCocoa.mm (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-08-25  Alex Christensen  <achristensen@webkit.org>
+
+        Crash in GraphicsContextGLOpenGL::reshapeDisplayBufferBacking
+        https://bugs.webkit.org/show_bug.cgi?id=229309
+
+        Reviewed by Myles C. Maxfield.
+
+        * fast/canvas/xr-compatible-crash.html: Added.
+        * fast/canvas/xr-compatible-crash-expected.txt: Added.
+
 2021-08-25  Aditya Keerthi  <akeerthi@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-08-25  Alex Christensen  <achristensen@webkit.org>
+
+        Crash in GraphicsContextGLOpenGL::reshapeDisplayBufferBacking
+        https://bugs.webkit.org/show_bug.cgi?id=229309
+
+        Reviewed by Myles C. Maxfield.
+
+        Test: fast/canvas/xr-compatible-crash.html
+
+        Null check m_swapChain because reshapeDisplayBufferBacking can be called before it is set.
+
+        * html/canvas/WebGLRenderingContextBase.cpp:
+        (WebCore::WebGLRenderingContextBase::addContextObject):
+        * platform/graphics/angle/GraphicsContextGLANGLE.cpp:
+        (WebCore::GraphicsContextGLOpenGL::reshapeFBOs):
+        * platform/graphics/cocoa/GraphicsContextGLOpenGLCocoa.mm:
+        (WebCore::GraphicsContextGLOpenGL::reshapeDisplayBufferBacking):
+
 2021-08-25  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp

@@ -6337 +6337 @@
         return;
 
-    ASSERT(!isContextLost());
     m_contextObjects.add(&object);
 }

trunk/Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp

@@ -150 +150 @@
     // resize regular FBO
     gl::BindFramebuffer(GL_FRAMEBUFFER, m_fbo);
-    ASSERT(m_texture);
 
 #if PLATFORM(COCOA)

trunk/Source/WebCore/platform/graphics/cocoa/GraphicsContextGLOpenGLCocoa.mm

@@ -622 +622 @@
     }
     // Reset the future recycled buffer now, because it most likely will not be reusable at the time it will be reused.
-    auto recycledBuffer = m_swapChain->recycleBuffer();
-    if (recycledBuffer.handle)
-        EGL_DestroySurface(m_displayObj, recycledBuffer.handle);
-    recycledBuffer.surface.reset();
+    if (m_swapChain) {
+        auto recycledBuffer = m_swapChain->recycleBuffer();
+        if (recycledBuffer.handle)
+            EGL_DestroySurface(m_displayObj, recycledBuffer.handle);
+        recycledBuffer.surface.reset();
+    }
     return allocateAndBindDisplayBufferBacking();
 }