Bug 329042
| Summary: | REGRESSION(318915@main): ANGLE: QueryContext EGL_CONTEXT_MEMORY_USAGE_ANGLE crashes with a large number of reserved names | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Kimmo Kinnunen <kkinnunen> |
| Component: | ANGLE | Assignee: | Kimmo Kinnunen <kkinnunen> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | djg, kbr, kkinnunen, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | All | ||
| OS: | All | ||
| Bug Depends on: | 190546 | ||
| Bug Blocks: | |||
Kimmo Kinnunen
Since 318915@main (bug 190546), the GPU process queries EGL_CONTEXT_MEMORY_USAGE_ANGLE after the WebGL calls that change memory use. Context::getMemoryUsage() walks the buffer, texture and renderbuffer resource maps.
glGen* reserves a name by storing a null object in the resource map until the name is first bound. The ResourceMap iterator skips these null objects in its flat arrays, but returns them for names stored in its hash map, and getTotalMemorySize() dereferences them. WebKit's ANGLE stores names from 0x3000 up in the hash map.
To reproduce: generate more than 0x3000 buffer, texture or renderbuffer names without binding them, then query EGL_CONTEXT_MEMORY_USAGE_ANGLE. The query crashes in gl::Buffer::getMemorySize() (or the texture or renderbuffer equivalent) with a null object.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Kimmo Kinnunen
<rdar://189684244>
Kimmo Kinnunen
Pull request: https://github.com/WebKit/WebKit/pull/78406
EWS
Committed 324979@main (ce11d7461d63): <https://commits.webkit.org/324979@main>
Reviewed commits have been landed. Closing PR #78406 and removing active labels.
EWS
Committed ? (6f0ad1f18f18): <https://commits.webkit.org/6f0ad1f18f18>
Reviewed commits have been landed. Closing PR #7554 and removing active labels.