From 93f4ab10fc87086544f2727d06fbcf5a7a1c3312 Mon Sep 17 00:00:00 2001
From: Nicolas Silva <nsilva@mozilla.com>
Date: Wed, 10 Aug 2022 11:38:56 +0000
Subject: [PATCH] Bug 1777535 - Validate mapAync mode on the parent side.
 r=jimb

Depends on D151632

Differential Revision: https://phabricator.services.mozilla.com/D151701
---
 dom/webgpu/Buffer.cpp           | 15 +--------------
 dom/webgpu/ipc/PWebGPU.ipdl     |  3 +--
 dom/webgpu/ipc/WebGPUChild.h    |  1 +
 dom/webgpu/ipc/WebGPUParent.cpp | 28 ++++++++++++++++++++++------
 dom/webgpu/ipc/WebGPUParent.h   |  2 +-
 5 files changed, 26 insertions(+), 23 deletions(-)

diff --git a/dom/webgpu/Buffer.cpp b/dom/webgpu/Buffer.cpp
index 851b1ccdd39c..a71e6180d99d 100644
--- a/dom/webgpu/Buffer.cpp
+++ b/dom/webgpu/Buffer.cpp
@@ -166,21 +166,8 @@ already_AddRefed<dom::Promise> Buffer::MapAsync(
 
   RefPtr<Buffer> self(this);
 
-  ffi::WGPUHostMap mode;
-  switch (aMode) {
-    case dom::GPUMapMode_Binding::READ:
-      mode = ffi::WGPUHostMap_Read;
-      break;
-    case dom::GPUMapMode_Binding::WRITE:
-      mode = ffi::WGPUHostMap_Write;
-      break;
-    default:
-      // TODO: This has to be validated on the device timeline.
-      MOZ_CRASH();
-  }
-
   auto mappingPromise =
-      GetDevice().GetBridge()->SendBufferMap(mId, mode, aOffset, size);
+      GetDevice().GetBridge()->SendBufferMap(mId, aMode, aOffset, size);
   MOZ_ASSERT(mappingPromise);
 
   mMapRequest = promise;
diff --git a/dom/webgpu/ipc/PWebGPU.ipdl b/dom/webgpu/ipc/PWebGPU.ipdl
index 188f839b1b6d..782ea9af1858 100644
--- a/dom/webgpu/ipc/PWebGPU.ipdl
+++ b/dom/webgpu/ipc/PWebGPU.ipdl
@@ -11,7 +11,6 @@ using RawId from "mozilla/webgpu/WebGPUTypes.h";
 using dom::GPURequestAdapterOptions from "mozilla/dom/WebGPUBinding.h";
 using dom::GPUCommandBufferDescriptor from "mozilla/dom/WebGPUBinding.h";
 using dom::GPUBufferDescriptor from "mozilla/dom/WebGPUBinding.h";
-using webgpu::ffi::WGPUHostMap from "mozilla/webgpu/ffi/wgpu.h";
 using MaybeScopedError from "mozilla/webgpu/WebGPUTypes.h";
 using WebGPUCompilationMessage from "mozilla/webgpu/WebGPUTypes.h";
 
@@ -48,7 +47,7 @@ parent:
   async AdapterDestroy(RawId selfId);
   // TODO: We want to return an array of compilation messages.
   async DeviceCreateShaderModule(RawId selfId, RawId bufferId, nsString label, nsCString code) returns (WebGPUCompilationMessage[] messages);
-  async BufferMap(RawId selfId, WGPUHostMap hostMap, uint64_t offset, uint64_t size) returns (BufferMapResult result);
+  async BufferMap(RawId selfId, uint32_t aMode, uint64_t offset, uint64_t size) returns (BufferMapResult result);
   async BufferUnmap(RawId selfId, bool flush);
   async BufferDestroy(RawId selfId);
   async TextureDestroy(RawId selfId);
diff --git a/dom/webgpu/ipc/WebGPUChild.h b/dom/webgpu/ipc/WebGPUChild.h
index 8dd1f5b77fc3..e3bc2a77527a 100644
--- a/dom/webgpu/ipc/WebGPUChild.h
+++ b/dom/webgpu/ipc/WebGPUChild.h
@@ -9,6 +9,7 @@
 #include "mozilla/webgpu/PWebGPUChild.h"
 #include "mozilla/MozPromise.h"
 #include "mozilla/WeakPtr.h"
+#include "mozilla/webgpu/ffi/wgpu.h"
 
 namespace mozilla {
 namespace dom {
diff --git a/dom/webgpu/ipc/WebGPUParent.cpp b/dom/webgpu/ipc/WebGPUParent.cpp
index f7cfe3d487a8..a429fb62d414 100644
--- a/dom/webgpu/ipc/WebGPUParent.cpp
+++ b/dom/webgpu/ipc/WebGPUParent.cpp
@@ -436,14 +436,30 @@ static void MapCallback(ffi::WGPUBufferMapAsyncStatus status,
   delete req;
 }
 
-ipc::IPCResult WebGPUParent::RecvBufferMap(RawId aBufferId,
-                                           ffi::WGPUHostMap aHostMap,
+ipc::IPCResult WebGPUParent::RecvBufferMap(RawId aBufferId, uint32_t aMode,
                                            uint64_t aOffset, uint64_t aSize,
                                            BufferMapResolver&& aResolver) {
   MOZ_LOG(sLogger, LogLevel::Info,
           ("RecvBufferMap %" PRIu64 " offset=%" PRIu64 " size=%" PRIu64 "\n",
            aBufferId, aOffset, aSize));
 
+  ffi::WGPUHostMap mode;
+  switch (aMode) {
+    case dom::GPUMapMode_Binding::READ:
+      mode = ffi::WGPUHostMap_Read;
+      break;
+    case dom::GPUMapMode_Binding::WRITE:
+      mode = ffi::WGPUHostMap_Write;
+      break;
+    default: {
+      nsCString errorString(
+          "GPUBuffer.mapAsync 'mode' argument must be either GPUMapMode.READ "
+          "or GPUMapMode.WRITE");
+      aResolver(BufferMapError(errorString));
+      return IPC_OK();
+    }
+  }
+
   auto* mapData = GetBufferMapData(aBufferId);
 
   if (!mapData) {
@@ -452,13 +468,13 @@ ipc::IPCResult WebGPUParent::RecvBufferMap(RawId aBufferId,
     return IPC_OK();
   }
 
-  auto* request = new MapRequest(this, mContext.get(), aBufferId, aHostMap,
-                                 aOffset, aSize, std::move(aResolver));
+  auto* request = new MapRequest(this, mContext.get(), aBufferId, mode, aOffset,
+                                 aSize, std::move(aResolver));
 
   ffi::WGPUBufferMapCallbackC callback = {&MapCallback,
                                           reinterpret_cast<uint8_t*>(request)};
-  ffi::wgpu_server_buffer_map(mContext.get(), aBufferId, aOffset, aSize,
-                              aHostMap, callback);
+  ffi::wgpu_server_buffer_map(mContext.get(), aBufferId, aOffset, aSize, mode,
+                              callback);
 
   return IPC_OK();
 }
diff --git a/dom/webgpu/ipc/WebGPUParent.h b/dom/webgpu/ipc/WebGPUParent.h
index 074ef18c0b17..419c508cc7bc 100644
--- a/dom/webgpu/ipc/WebGPUParent.h
+++ b/dom/webgpu/ipc/WebGPUParent.h
@@ -38,7 +38,7 @@ class WebGPUParent final : public PWebGPUParent {
                                   dom::GPUBufferDescriptor&& aDesc,
                                   MaybeShmem&& aShmem);
   ipc::IPCResult RecvBufferReturnShmem(RawId aBufferId, Shmem&& aShmem);
-  ipc::IPCResult RecvBufferMap(RawId aBufferId, ffi::WGPUHostMap aHostMap,
+  ipc::IPCResult RecvBufferMap(RawId aBufferId, uint32_t aMode,
                                uint64_t aOffset, uint64_t size,
                                BufferMapResolver&& aResolver);
   ipc::IPCResult RecvBufferUnmap(RawId aBufferId, bool aFlush);