Bug 1816731 Part 1: Prevent configuration of a WebGPU context for a too-big canvas. r=webgpu-reviewers,ErichDonGubler

Differential Revision: https://phabricator.services.mozilla.com/D193567

dom/webgpu/CanvasContext.cpp

@@ -100,6 +100,8 @@ void CanvasContext::GetCanvas(
 void CanvasContext::Configure(const dom::GPUCanvasConfiguration& aConfig) {
   Unconfigure();
 
+  // Bug 1864904: Failures in validation should throw a TypeError, per spec.
+
   // these formats are guaranteed by the spec
   switch (aConfig.mFormat) {
     case dom::GPUTextureFormat::Rgba8unorm:

dom/webgpu/Device.cpp

@@ -43,6 +43,13 @@ GPU_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_INHERITED(Device, DOMEventTargetHelper,
 NS_IMPL_ISUPPORTS_CYCLE_COLLECTION_INHERITED_0(Device, DOMEventTargetHelper)
 GPU_IMPL_JS_WRAP(Device)
 
+/* static */ CheckedInt<uint32_t> Device::BufferStrideWithMask(
+    const gfx::IntSize& aSize, const gfx::SurfaceFormat& aFormat) {
+  constexpr uint32_t kBufferAlignmentMask = 0xff;
+  return CheckedInt<uint32_t>(aSize.width) * gfx::BytesPerPixel(aFormat) +
+         kBufferAlignmentMask;
+}
+
 RefPtr<WebGPUChild> Device::GetBridge() { return mBridge; }
 
 Device::Device(Adapter* const aParent, RawId aId,
@@ -358,6 +365,13 @@ already_AddRefed<Texture> Device::InitSwapChain(
     return nullptr;
   }
 
+  // Check that aCanvasSize and aFormat will generate a texture stride
+  // within limits.
+  const auto bufferStrideWithMask = BufferStrideWithMask(aCanvasSize, aFormat);
+  if (!bufferStrideWithMask.isValid()) {
+    return nullptr;
+  }
+
   const layers::RGBDescriptor rgbDesc(aCanvasSize, aFormat);
   // buffer count doesn't matter much, will be created on demand
   const size_t maxBufferCount = 10;

dom/webgpu/Device.h

@@ -90,6 +90,9 @@ class Device final : public DOMEventTargetHelper, public SupportsWeakPtr {
   RefPtr<SupportedFeatures> mFeatures;
   RefPtr<SupportedLimits> mLimits;
 
+  static CheckedInt<uint32_t> BufferStrideWithMask(
+      const gfx::IntSize& aSize, const gfx::SurfaceFormat& aFormat);
+
   explicit Device(Adapter* const aParent, RawId aId, const ffi::WGPULimits&);
 
   RefPtr<WebGPUChild> GetBridge();

dom/webgpu/ipc/WebGPUParent.cpp

@@ -864,15 +864,14 @@ ipc::IPCResult WebGPUParent::RecvDeviceCreateSwapChain(
       return IPC_OK();
   }
 
-  constexpr uint32_t kBufferAlignmentMask = 0xff;
-  const auto bufferStrideWithMask = CheckedInt<uint32_t>(aDesc.size().width) *
-                                        gfx::BytesPerPixel(aDesc.format()) +
-                                    kBufferAlignmentMask;
+  const auto bufferStrideWithMask =
+      Device::BufferStrideWithMask(aDesc.size(), aDesc.format());
   if (!bufferStrideWithMask.isValid()) {
     MOZ_ASSERT_UNREACHABLE("Invalid width / buffer stride!");
     return IPC_OK();
   }
 
+  constexpr uint32_t kBufferAlignmentMask = 0xff;
   const uint32_t bufferStride =
       bufferStrideWithMask.value() & ~kBufferAlignmentMask;