Bug 1739454 - Don't allow write-mapping of SourceSurfaceSharedData after Finalize. r=aosmond

Differential Revision: https://phabricator.services.mozilla.com/D131584

gfx/layers/SourceSurfaceSharedData.cpp

@@ -92,10 +92,15 @@ bool SourceSurfaceSharedDataWrapper::EnsureMapped(size_t aLength) {
   return true;
 }
 
-bool SourceSurfaceSharedDataWrapper::Map(MapType,
+bool SourceSurfaceSharedDataWrapper::Map(MapType aMapType,
                                          MappedSurface* aMappedSurface) {
   uint8_t* dataPtr;
 
+  if (aMapType != MapType::READ) {
+    // The data may be write-protected
+    return false;
+  }
+
   if (mHandleLock) {
     MutexAutoLock lock(*mHandleLock);
     dataPtr = GetData();

gfx/layers/SourceSurfaceSharedData.h

@@ -65,7 +65,7 @@ class SourceSurfaceSharedDataWrapper final : public DataSourceSurface {
 
   bool OnHeap() const override { return false; }
 
-  bool Map(MapType, MappedSurface* aMappedSurface) final;
+  bool Map(MapType aMapType, MappedSurface* aMappedSurface) final;
 
   void Unmap() final;
 
@@ -174,8 +174,12 @@ class SourceSurfaceSharedData : public DataSourceSurface {
    * the same data pointer by retaining the old shared buffer until
    * the last mapping is freed via Unmap.
    */
-  bool Map(MapType, MappedSurface* aMappedSurface) final {
+  bool Map(MapType aMapType, MappedSurface* aMappedSurface) final {
     MutexAutoLock lock(mMutex);
+    if (mFinalized && aMapType != MapType::READ) {
+      // Once finalized the data may be write-protected
+      return false;
+    }
     ++mMapCount;
     aMappedSurface->mData = GetDataInternal();
     aMappedSurface->mStride = mStride;

gfx/webrender_bindings/RenderBufferTextureHost.cpp

@@ -65,8 +65,8 @@ wr::WrExternalImage RenderBufferTextureHost::Lock(
         gfxCriticalNote << "DataSourceSurface is null";
         return InvalidToWrExternalImage();
       }
-      if (NS_WARN_IF(!mSurface->Map(gfx::DataSourceSurface::MapType::READ_WRITE,
-                                    &mMap))) {
+      if (NS_WARN_IF(
+              !mSurface->Map(gfx::DataSourceSurface::MapType::READ, &mMap))) {
         mSurface = nullptr;
         gfxCriticalNote << "Failed to map Surface";
         return InvalidToWrExternalImage();
@@ -89,11 +89,10 @@ wr::WrExternalImage RenderBufferTextureHost::Lock(
         return InvalidToWrExternalImage();
       }
       if (NS_WARN_IF(
-              !mYSurface->Map(gfx::DataSourceSurface::MapType::READ_WRITE,
-                              &mYMap) ||
-              !mCbSurface->Map(gfx::DataSourceSurface::MapType::READ_WRITE,
+              !mYSurface->Map(gfx::DataSourceSurface::MapType::READ, &mYMap) ||
+              !mCbSurface->Map(gfx::DataSourceSurface::MapType::READ,
                                &mCbMap) ||
-              !mCrSurface->Map(gfx::DataSourceSurface::MapType::READ_WRITE,
+              !mCrSurface->Map(gfx::DataSourceSurface::MapType::READ,
                                &mCrMap))) {
         mYSurface = mCbSurface = mCrSurface = nullptr;
         gfxCriticalNote << "Failed to map YCbCr Surface";

gfx/webrender_bindings/RenderSharedSurfaceTextureHost.cpp

@@ -27,8 +27,8 @@ RenderSharedSurfaceTextureHost::~RenderSharedSurfaceTextureHost() {
 wr::WrExternalImage RenderSharedSurfaceTextureHost::Lock(
     uint8_t aChannelIndex, gl::GLContext* aGL, wr::ImageRendering aRendering) {
   if (!mLocked) {
-    if (NS_WARN_IF(!mSurface->Map(gfx::DataSourceSurface::MapType::READ_WRITE,
-                                  &mMap))) {
+    if (NS_WARN_IF(
+            !mSurface->Map(gfx::DataSourceSurface::MapType::READ, &mMap))) {
       return InvalidToWrExternalImage();
     }
     mLocked = true;