Bug 1566206 - Avoid overflow when limitting the number of rasterized blobs. r=jrmuizel, a=jcristau
Differential Revision:
https://phabricator.services.mozilla.com/D38292
--- a/gfx/wr/webrender/src/resource_cache.rs
+++ b/gfx/wr/webrender/src/resource_cache.rs
@@ -1211,18 +1211,19 @@ impl ResourceCache {
const MAX_TILES_PER_REQUEST: i32 = 512;
// For truly nonsensical requests, we might run into overflow
// when computing width * height, so we first check each extent
// individually.
while !tiles.size.is_empty_or_negative()
&& (tiles.size.width > MAX_TILES_PER_REQUEST
|| tiles.size.height > MAX_TILES_PER_REQUEST
|| tiles.size.width * tiles.size.height > MAX_TILES_PER_REQUEST) {
- let w = tiles.size.width;
- let h = tiles.size.height;
+ let limit = 46340; // sqrt(i32::MAX) rounded down to avoid overflow.
+ let w = tiles.size.width.min(limit);
+ let h = tiles.size.height.min(limit);
let diff = w * h - MAX_TILES_PER_REQUEST;
// Remove tiles in the largest dimension.
if tiles.size.width > tiles.size.height {
tiles.size.width -= diff / h + 1;
tiles.origin.x += diff / (2 * h);
} else {
tiles.size.height -= diff / w + 1;
tiles.origin.y += diff / (2 * w);