Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/ChangeLog (279330 => 279331)
--- releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/ChangeLog 2021-06-28 11:49:48 UTC (rev 279330)
+++ releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/ChangeLog 2021-06-28 11:52:38 UTC (rev 279331)
@@ -1,3 +1,38 @@
+2021-05-27 Kimmo Kinnunen <[email protected]>
+
+ Cherry-pick ANGLE: D3D11: Skip blits if there is no intersection of dest areas
+ https://bugs.webkit.org/show_bug.cgi?id=225190
+ <rdar://77084155>
+
+ Reviewed by David Kilzer.
+
+ Cherry-pick ANGLE commit b574643ef28c92fcea5122dd7a72acb42a514eed
+ Fixes a security issue on D3D11.
+ Potential a correctness issue on some OpenGL drivers.
+ No effect on Metal, but the nodiscard part is still useful.
+
+ Upstream description:
+ D3D11: Skip blits if there is no intersection of dest areas
+
+ Blit11 would clip the destination rectangle with the destination size
+ but ignore the result. gl::ClipRectangle returns false when the
+ rectangles do not intersect at all, indicating the blit can be skipped.
+
+ This could lead to an out-of-bounds write to the GPU memory for the
+ destination texture.
+
+ Mark ClipRectangle as nodiscard to prevent future issues.
+ * src/libANGLE/angletypes.h:
+ * src/libANGLE/renderer/d3d/d3d11/Blit11.cpp:
+ * src/libANGLE/renderer/gl/FramebufferGL.cpp:
+ (rx::FramebufferGL::clipSrcRegion):
+ * src/libANGLE/renderer/metal/ContextMtl.mm:
+ (rx::ContextMtl::updateScissor):
+ * src/libANGLE/renderer/vulkan/ContextVk.cpp:
+ (rx::ContextVk::updateScissor):
+ * src/tests/gl_tests/BlitFramebufferANGLETest.cpp:
+ (TEST_P):
+
2021-02-25 Kyle Piddington <[email protected]>
Fix crashes in fast/canvas/webgl/texImage video tests
Modified: releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/angletypes.h (279330 => 279331)
--- releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/angletypes.h 2021-06-28 11:49:48 UTC (rev 279330)
+++ releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/angletypes.h 2021-06-28 11:52:38 UTC (rev 279331)
@@ -84,7 +84,9 @@
bool operator!=(const Rectangle &a, const Rectangle &b);
// Calculate the intersection of two rectangles. Returns false if the intersection is empty.
-bool ClipRectangle(const Rectangle &source, const Rectangle &clip, Rectangle *intersection);
+ANGLE_NO_DISCARD bool ClipRectangle(const Rectangle &source,
+ const Rectangle &clip,
+ Rectangle *intersection);
// Calculate the smallest rectangle that covers both rectangles. This rectangle may cover areas
// not covered by the two rectangles, for example in this situation:
//
Modified: releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Blit11.cpp (279330 => 279331)
--- releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Blit11.cpp 2021-06-28 11:49:48 UTC (rev 279330)
+++ releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Blit11.cpp 2021-06-28 11:52:38 UTC (rev 279331)
@@ -141,7 +141,10 @@
uint8_t *destData)
{
gl::Rectangle clippedDestArea(destArea.x, destArea.y, destArea.width, destArea.height);
- gl::ClipRectangle(clippedDestArea, clipRect, &clippedDestArea);
+ if (!gl::ClipRectangle(clippedDestArea, clipRect, &clippedDestArea))
+ {
+ return;
+ }
// Determine if entire rows can be copied at once instead of each individual pixel. There
// must be no out of bounds lookups, whole rows copies, and no scale.
Modified: releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/FramebufferGL.cpp (279330 => 279331)
--- releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/FramebufferGL.cpp 2021-06-28 11:49:48 UTC (rev 279330)
+++ releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/FramebufferGL.cpp 2021-06-28 11:52:38 UTC (rev 279331)
@@ -1117,7 +1117,10 @@
// If pixels lying outside the read framebuffer, adjust src region
// and dst region to appropriate in-bounds regions respectively.
gl::Rectangle realSourceRegion;
- ClipRectangle(bounds.sourceRegion, bounds.sourceBounds, &realSourceRegion);
+ if (!ClipRectangle(bounds.sourceRegion, bounds.sourceBounds, &realSourceRegion))
+ {
+ return angle::Result::Stop;
+ }
GLuint xOffset = realSourceRegion.x - bounds.sourceRegion.x;
GLuint yOffset = realSourceRegion.y - bounds.sourceRegion.y;
Modified: releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.mm (279330 => 279331)
--- releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.mm 2021-06-28 11:49:48 UTC (rev 279330)
+++ releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.mm 2021-06-28 11:52:38 UTC (rev 279331)
@@ -1836,7 +1836,10 @@
// Clip the render area to the viewport.
gl::Rectangle viewportClippedRenderArea;
- gl::ClipRectangle(renderArea, glState.getViewport(), &viewportClippedRenderArea);
+ if (!gl::ClipRectangle(renderArea, glState.getViewport(), &viewportClippedRenderArea))
+ {
+ viewportClippedRenderArea = gl::Rectangle();
+ }
gl::Rectangle scissoredArea = ClipRectToScissor(getState(), viewportClippedRenderArea, false);
if (framebufferMtl->flipY())
Modified: releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ContextVk.cpp (279330 => 279331)
--- releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ContextVk.cpp 2021-06-28 11:49:48 UTC (rev 279330)
+++ releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ContextVk.cpp 2021-06-28 11:52:38 UTC (rev 279331)
@@ -2616,8 +2616,11 @@
// Clip the render area to the viewport.
gl::Rectangle viewportClippedRenderArea;
- gl::ClipRectangle(renderArea, getCorrectedViewport(glState.getViewport()),
- &viewportClippedRenderArea);
+ if (!gl::ClipRectangle(renderArea, getCorrectedViewport(glState.getViewport()),
+ &viewportClippedRenderArea))
+ {
+ viewportClippedRenderArea = gl::Rectangle();
+ }
gl::Rectangle scissoredArea = ClipRectToScissor(getState(), viewportClippedRenderArea, false);
gl::Rectangle rotatedScissoredArea;
Modified: releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/tests/gl_tests/BlitFramebufferANGLETest.cpp (279330 => 279331)
--- releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/tests/gl_tests/BlitFramebufferANGLETest.cpp 2021-06-28 11:49:48 UTC (rev 279330)
+++ releases/WebKitGTK/webkit-2.32/Source/ThirdParty/ANGLE/src/tests/gl_tests/BlitFramebufferANGLETest.cpp 2021-06-28 11:52:38 UTC (rev 279331)
@@ -2437,6 +2437,30 @@
EXPECT_GL_ERROR(GL_INVALID_VALUE);
}
+// Test an edge case in D3D11 stencil blitting on the CPU that does not properly clip the
+// destination regions
+TEST_P(BlitFramebufferTest, BlitFramebufferStencilClipNoIntersection)
+{
+ GLFramebuffer framebuffers[2];
+ glBindFramebuffer(GL_READ_FRAMEBUFFER, framebuffers[0]);
+ glBindFramebuffer(GL_DRAW_FRAMEBUFFER, framebuffers[1]);
+
+ GLRenderbuffer renderbuffers[2];
+ glBindRenderbuffer(GL_RENDERBUFFER, renderbuffers[0]);
+ glRenderbufferStorage(GL_RENDERBUFFER, GL_DEPTH24_STENCIL8, 4, 4);
+ glFramebufferRenderbuffer(GL_READ_FRAMEBUFFER, GL_STENCIL_ATTACHMENT, GL_RENDERBUFFER,
+ renderbuffers[0]);
+
+ glBindRenderbuffer(GL_RENDERBUFFER, renderbuffers[1]);
+ glRenderbufferStorage(GL_RENDERBUFFER, GL_DEPTH24_STENCIL8, 4, 4);
+ glFramebufferRenderbuffer(GL_DRAW_FRAMEBUFFER, GL_STENCIL_ATTACHMENT, GL_RENDERBUFFER,
+ renderbuffers[1]);
+
+ glBlitFramebuffer(0, 0, 4, 4, 1 << 24, 1 << 24, 1 << 25, 1 << 25, GL_STENCIL_BUFFER_BIT,
+ GL_NEAREST);
+ EXPECT_GL_NO_ERROR();
+}
+
// Use this to select which configurations (e.g. which renderer, which GLES major version) these
// tests should be run against.
ANGLE_INSTANTIATE_TEST(BlitFramebufferANGLETest,
