wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 23:38:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

Merge remote-tracking branch 'origin/tracking' into custom

Browse source
This commit is contained in:
roytam1 2024-10-03 14:35:59 +08:00
commit 73f3390cf8
5 changed files with 62 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

35
dom/media/gmp/GMPVideoi420FrameImpl.cpp
View file

@ -89,6 +89,34 @@ GMPVideoi420FrameImpl::CheckFrameData(const GMPVideoi420FrameData& aFrameData)
return true;
}
bool
GMPVideoi420FrameImpl::CheckDimensions(int32_t aWidth, int32_t aHeight,
int32_t aStride_y,
int32_t aStride_u,
int32_t aStride_v, int32_t aSize_y,
int32_t aSize_u, int32_t aSize_v) {
if (aWidth < 1 || aHeight < 1 || aStride_y < aWidth || aSize_y < 1 ||
aSize_u < 1 || aSize_v < 1) {
return false;
}
auto halfWidth = (CheckedInt<int32_t>(aWidth) + 1) / 2;
if (!halfWidth.isValid() || aStride_u < halfWidth.value() ||
aStride_v < halfWidth.value()) {
return false;
}
auto height = CheckedInt<int32_t>(aHeight);
auto halfHeight = (height + 1) / 2;
auto minSizeY = height * aStride_y;
auto minSizeU = halfHeight * aStride_u;
auto minSizeV = halfHeight * aStride_v;
if (!minSizeY.isValid() || !minSizeU.isValid() || !minSizeV.isValid() ||
minSizeY.value() > aSize_y || minSizeU.value() > aSize_u ||
minSizeV.value() > aSize_v) {
return false;
}
return true;
}
bool
GMPVideoi420FrameImpl::CheckDimensions(int32_t aWidth, int32_t aHeight,
int32_t aStride_y, int32_t aStride_u, int32_t aStride_v)
@ -179,11 +207,8 @@ GMPVideoi420FrameImpl::CreateFrame(int32_t aSize_y, const uint8_t* aBuffer_y,
MOZ_ASSERT(aBuffer_u);
MOZ_ASSERT(aBuffer_v);
if (aSize_y < 1 || aSize_u < 1 || aSize_v < 1) {
return GMPGenericErr;
}
if (!CheckDimensions(aWidth, aHeight, aStride_y, aStride_u, aStride_v)) {
if (!CheckDimensions(aWidth, aHeight, aStride_y, aStride_u, aStride_v,
aSize_y, aSize_u, aSize_v)) {
return GMPGenericErr;
}

3
dom/media/gmp/GMPVideoi420FrameImpl.h
View file

@ -65,6 +65,9 @@ public:
void ResetSize() override;
private:
bool CheckDimensions(int32_t aWidth, int32_t aHeight, int32_t aStride_y,
int32_t aStride_u, int32_t aStride_v, int32_t aSize_y,
int32_t aSize_u, int32_t aSize_v);
bool CheckDimensions(int32_t aWidth, int32_t aHeight,
int32_t aStride_y, int32_t aStride_u, int32_t aStride_v);

1
js/public/StructuredClone.h
View file

@ -472,6 +472,7 @@ class JS_PUBLIC_API(JSAutoStructuredCloneBuffer) {
#define JS_SCERR_TRANSFERABLE 1
#define JS_SCERR_DUP_TRANSFERABLE 2
#define JS_SCERR_UNSUPPORTED_TYPE 3
#define JS_SCERR_TRANSFERABLE_TWICE 4
JS_PUBLIC_API(bool)
JS_ReadUint32Pair(JSStructuredCloneReader* r, uint32_t* p1, uint32_t* p2);

1
js/src/js.msg
View file

@ -440,6 +440,7 @@ MSG_DEF(JSMSG_SC_BAD_CLONE_VERSION, 0, JSEXN_ERR, "unsupported structured clo
MSG_DEF(JSMSG_SC_BAD_SERIALIZED_DATA, 1, JSEXN_INTERNALERR, "bad serialized structured data ({0})")
MSG_DEF(JSMSG_SC_DUP_TRANSFERABLE, 0, JSEXN_TYPEERR, "duplicate transferable for structured clone")
MSG_DEF(JSMSG_SC_NOT_TRANSFERABLE, 0, JSEXN_TYPEERR, "invalid transferable array for structured clone")
MSG_DEF(JSMSG_SC_TRANSFERABLE_TWICE, 0, JSEXN_TYPEERR, "structured clone cannot transfer twice")
MSG_DEF(JSMSG_SC_UNSUPPORTED_TYPE, 0, JSEXN_TYPEERR, "unsupported type for structured data")
MSG_DEF(JSMSG_SC_NOT_CLONABLE, 1, JSEXN_TYPEERR, "{0} cannot be cloned in this context")
MSG_DEF(JSMSG_SC_SAB_TRANSFER, 0, JSEXN_WARN, "SharedArrayBuffer must not be in the transfer list")

36
js/src/vm/StructuredClone.cpp
View file

@ -140,18 +140,23 @@ enum StructuredDataType : uint32_t {
/*
* Format of transfer map:
* <SCTAG_TRANSFER_MAP_HEADER, TransferableMapHeader(UNREAD|TRANSFERRED)>
* numTransferables (64 bits)
* array of:
* <SCTAG_TRANSFER_MAP_*, TransferableOwnership>
* pointer (64 bits)
* extraData (64 bits), eg byte length for ArrayBuffers
* - <SCTAG_TRANSFER_MAP_HEADER, UNREAD|TRANSFERRING|TRANSFERRED>
* - numTransferables (64 bits)
* - array of:
* - <SCTAG_TRANSFER_MAP_*, TransferableOwnership> pointer (64
* bits)
* - extraData (64 bits), eg byte length for ArrayBuffers
* - any data written for custom transferables
*/
// Data associated with an SCTAG_TRANSFER_MAP_HEADER that tells whether the
// contents have been read out yet or not.
// contents have been read out yet or not. TRANSFERRING is for the case where we
// have started but not completed reading, which due to errors could mean that
// there are things still owned by the clone buffer that need to be released, so
// discarding should not just be skipped.
enum TransferableMapHeader {
SCTAG_TM_UNREAD = 0,
SCTAG_TM_TRANSFERRING,
SCTAG_TM_TRANSFERRED
};
@ -530,6 +535,10 @@ ReportDataCloneError(JSContext* cx,
JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_SC_UNSUPPORTED_TYPE);
break;
case JS_SCERR_TRANSFERABLE_TWICE:
JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_SC_TRANSFERABLE_TWICE);
break;
default:
MOZ_CRASH("Unkown errorId");
break;
@ -2325,9 +2334,18 @@ JSStructuredCloneReader::readTransferMap()
if (!in.getPair(&tag, &data))
return in.reportTruncated();
if (tag != SCTAG_TRANSFER_MAP_HEADER || TransferableMapHeader(data) == SCTAG_TM_TRANSFERRED)
auto transferState = static_cast<TransferableMapHeader>(data);
if (tag != SCTAG_TRANSFER_MAP_HEADER || transferState == SCTAG_TM_TRANSFERRED)
return true;
if (transferState == SCTAG_TM_TRANSFERRING) {
ReportDataCloneError(cx, callbacks, JS_SCERR_TRANSFERABLE_TWICE);
return false;
}
headerPos.write(PairToUInt64(SCTAG_TRANSFER_MAP_HEADER, SCTAG_TM_TRANSFERRING));
uint64_t numTransferables;
MOZ_ALWAYS_TRUE(in.readPair(&tag, &data));
if (!in.read(&numTransferables))
@ -2414,7 +2432,7 @@ JSStructuredCloneReader::readTransferMap()
#ifdef DEBUG
SCInput::getPair(headerPos.peek(), &tag, &data);
MOZ_ASSERT(tag == SCTAG_TRANSFER_MAP_HEADER);
MOZ_ASSERT(TransferableMapHeader(data) != SCTAG_TM_TRANSFERRED);
MOZ_ASSERT(TransferableMapHeader(data) == SCTAG_TM_TRANSFERRING);
#endif
headerPos.write(PairToUInt64(SCTAG_TRANSFER_MAP_HEADER, SCTAG_TM_TRANSFERRED));