author | Steve Fink <sfink@mozilla.com> |
Mon, 07 Jan 2013 15:12:06 -0800 (2013-01-07) | |
changeset 118018 | 669bc3bb9a87533e3b9d8e17551f49f5ec8efd6f |
parent 118017 | 0757dd0a653dafa77e4ce25bea290e9ee22c6508 |
child 118019 | 63d127cca94ca92f63e1a5df770a94e31248a720 |
push id | 24144 |
push user | emorley@mozilla.com |
push date | Tue, 08 Jan 2013 11:32:43 +0000 (2013-01-08) |
treeherder | mozilla-central@dccab70d8554 [default view] [failures only] |
perfherder | [talos] [build metrics] [platform microbench] (compared to previous push) |
reviewers | bz |
bugs | 827225 |
milestone | 20.0a1 |
first release with | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
last release without | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
--- a/content/canvas/src/WebGLContextGL.cpp +++ b/content/canvas/src/WebGLContextGL.cpp @@ -3161,19 +3161,16 @@ WebGLContext::ReadPixels(WebGLint x, Web if (!pixels) return ErrorInvalidValue("readPixels: null destination buffer"); const WebGLRectangleObject *framebufferRect = FramebufferRectangleObject(); WebGLsizei framebufferWidth = framebufferRect ? framebufferRect->Width() : 0; WebGLsizei framebufferHeight = framebufferRect ? framebufferRect->Height() : 0; - uint32_t dataByteLen = JS_GetTypedArrayByteLength(pixels->Obj()); - int dataType = JS_GetArrayBufferViewType(pixels->Obj()); - uint32_t channels = 0; // Check the format param switch (format) { case LOCAL_GL_ALPHA: channels = 1; break; case LOCAL_GL_RGB: @@ -3200,32 +3197,35 @@ WebGLContext::ReadPixels(WebGLint x, Web case LOCAL_GL_UNSIGNED_SHORT_5_6_5: bytesPerPixel = 2; requiredDataType = js::ArrayBufferView::TYPE_UINT16; break; default: return ErrorInvalidEnum("readPixels: Bad type"); } + int dataType = JS_GetArrayBufferViewType(pixels->Obj()); + // Check the pixels param type if (dataType != requiredDataType) return ErrorInvalidOperation("readPixels: Mismatched type/pixels types"); // Check the pixels param size CheckedUint32 checked_neededByteLength = GetImageSize(height, width, bytesPerPixel, mPixelStorePackAlignment); CheckedUint32 checked_plainRowSize = CheckedUint32(width) * bytesPerPixel; CheckedUint32 checked_alignedRowSize = RoundedToNextMultipleOf(checked_plainRowSize, mPixelStorePackAlignment); if (!checked_neededByteLength.isValid()) return ErrorInvalidOperation("readPixels: integer overflow computing the needed buffer size"); + uint32_t dataByteLen = JS_GetTypedArrayByteLength(pixels->Obj()); if (checked_neededByteLength.value() > dataByteLen) return ErrorInvalidOperation("readPixels: buffer too small"); void* data = pixels->Data(); if (!data) { ErrorOutOfMemory("readPixels: buffer storage is null. Did we run out of memory?"); return rv.Throw(NS_ERROR_OUT_OF_MEMORY); }