Copied from: https://hg.mozilla.org/releases/mozilla-esr38/rev/f9aad6c0253a Security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2016-03/ Mozilla Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1220450 # HG changeset patch # User Jeff Gilbert # Date 1452570660 28800 # Node ID f9aad6c0253a3b81699a3d7a05e78615dd814ea3 # Parent c47640f24251b48c0bba9d2f0f6ee059eca58362 Bug 1220450 - Clear length on cache OOM. r=kamidphish, a=ritu diff --git a/dom/canvas/WebGLContextBuffers.cpp b/dom/canvas/WebGLContextBuffers.cpp --- a/dom/canvas/WebGLContextBuffers.cpp +++ b/dom/canvas/WebGLContextBuffers.cpp @@ -185,16 +185,17 @@ WebGLContext::BufferData(GLenum target, if (error) { GenerateWarning("bufferData generated error %s", ErrorName(error)); return; } boundBuffer->SetByteLength(size); if (!boundBuffer->ElementArrayCacheBufferData(nullptr, size)) { + boundBuffer->SetByteLength(0); return ErrorOutOfMemory("bufferData: out of memory"); } } void WebGLContext::BufferData(GLenum target, const dom::Nullable& maybeData, GLenum usage) @@ -234,18 +235,20 @@ WebGLContext::BufferData(GLenum target, GLenum error = CheckedBufferData(target, data.Length(), data.Data(), usage); if (error) { GenerateWarning("bufferData generated error %s", ErrorName(error)); return; } boundBuffer->SetByteLength(data.Length()); - if (!boundBuffer->ElementArrayCacheBufferData(data.Data(), data.Length())) + if (!boundBuffer->ElementArrayCacheBufferData(data.Data(), data.Length())) { + boundBuffer->SetByteLength(0); return ErrorOutOfMemory("bufferData: out of memory"); + } } void WebGLContext::BufferData(GLenum target, const dom::ArrayBufferView& data, GLenum usage) { if (IsContextLost()) return; @@ -274,18 +277,20 @@ WebGLContext::BufferData(GLenum target, GLenum error = CheckedBufferData(target, data.Length(), data.Data(), usage); if (error) { GenerateWarning("bufferData generated error %s", ErrorName(error)); return; } boundBuffer->SetByteLength(data.Length()); - if (!boundBuffer->ElementArrayCacheBufferData(data.Data(), data.Length())) + if (!boundBuffer->ElementArrayCacheBufferData(data.Data(), data.Length())) { + boundBuffer->SetByteLength(0); return ErrorOutOfMemory("bufferData: out of memory"); + } } void WebGLContext::BufferSubData(GLenum target, WebGLsizeiptr byteOffset, const dom::Nullable& maybeData) { if (IsContextLost()) return;