Bug 1041785 - fix a null deref crash in WebGL draw-call validation - r=kamidphish

content/canvas/src/WebGLContext.h

@@ -890,7 +890,7 @@ private:
     bool DrawArrays_check(GLint first, GLsizei count, GLsizei primcount, const char* info);
     bool DrawElements_check(GLsizei count, GLenum type, WebGLintptr byteOffset,
                             GLsizei primcount, const char* info,
-                            GLuint* out_upperBound = nullptr);
+                            GLuint* out_upperBound);
     bool DrawInstanced_check(const char* info);
     void Draw_cleanup();
 

content/canvas/src/WebGLContextDraw.cpp

@@ -333,7 +333,9 @@ WebGLContext::DrawElementsInstanced(GLenum mode, GLsizei count, GLenum type,
     if (!ValidateDrawModeEnum(mode, "drawElementsInstanced: mode"))
         return;
 
-    if (!DrawElements_check(count, type, byteOffset, primcount, "drawElementsInstanced"))
+    GLuint upperBound = 0;
+    if (!DrawElements_check(count, type, byteOffset, primcount, "drawElementsInstanced",
+                            &upperBound))
         return;
 
     RunContextLossTimer();